Cyber Resilience Act & EU Product Liability in Practice

Basics

• Introduction to the objectives of CRA, NIS 2, and the EU Product Liability Directive to better understand the framework conditions and background, such as digital sovereignty in the EU.
• Scope of the CRA as distinct from NIS 2 and the AI Act.
• Classification of software and products with digital elements into risk classes according to the Cyber Resilience Act (CRA) and the associated obligations.
• Responsible actors.
• Persons responsible within the company for implementing the CRA in practice.

Software Bill of Materials (SBOM)

• Contents, format, and provision of software bill of materials (SBOM).
• Solution approaches and standards such as the BSI guidelines for ensuring transparency and increasing security in the software supply chain (Software Supply Chain Security).

Security requirements and cybersecurity measures for software and products with digital elements in the CRA

• Content of cybersecurity strategies from development to market launch and in the supply chain, OSS compliance.
• Security by design, update obligations throughout the entire product life cycle of software.
• The need for continuous safety management.
• Ensuring the cybersecurity of digital components, IoT products, and functional safety through security by design and strict reporting requirements.
• What do the five-year update obligations mean for product cybersecurity in practice?

Conformity assessment procedures and CE marking

• Conformity assessment procedures.
• Practical implementation of the CE marking requirement for products.

Scope of CRA liability for products with open source software code, including license management and liability exclusions

• Approaches to the secure use of open-source software in products in the supply chain.
• Responsibilities, exceptions, legal and contractual liability.

Reporting obligations in the event of security incidents

• Overview of reporting requirements and response times for security incidents to prevent sanctions.

Implementation deadlines, legal consequences of violations

• Deadlines for implementing the new requirements and affixing the CE marking.
• Sanctions, fines, and other consequences for violations of the new rules.
• Ways out and exceptions.

EU product liability for software

• Explanation of strict EU product liability for software, digital technologies, and artificial intelligence.
• Changes resulting from the planned EU Product Liability Directive in the case of defective software and distinction from liability for defects.
• Scope of the new regulations.
• Responsible parties and scope of liability.
• Solutions for reducing liability.
• Product liability for high-risk AI systems under the AI Regulation and the CRA.