On September 11 and 12, new obligations under the Cyber Resilience Act and the Data Act came into force. What exactly is changing?
Those who follow European legislation closely have had extra work in recent days. On September 11 and 12, new obligations for IT companies came into effect under various legislative frameworks. Specifically, these are the Cyber Resilience Act (CRA) and the Data Act. The overarching goal of these laws is to increase software security and achieve a fair exchange of data between digital service providers and their customers.
Are you not yet up to speed with the new European rules that have taken effect? We have summarized them in this overview.
CRA: Mandatory Reporting
The European Cyber Resilience Act was drafted by the European Union in 2023 and formally adopted a year later. However, the most important obligations of the legislation have only now come into force. The CRA requires manufacturers of products with ‘digital elements’—which includes both hardware and software—to report vulnerabilities in their products from now on, preferably before they are exploited.
The reporting obligation starts from the moment the manufacturer notices a serious vulnerability or a specific incident with its products. Under ‘serious’, the CRA understands that the ability to secure sensitive or personal user data is compromised, or that there is an injection of malicious code. An initial report must be made within 24 hours, followed by a comprehensive report within 72 hours.
Special attention for open source
Although the CRA aims to encourage manufacturers to take security seriously, concerns about the legislation were initially voiced by the open-source community. These stemmed from the fact that, unlike commercial software, it is more difficult to designate a single party as ultimately responsible. This would complicate the launch of new projects, as we heard during previous editions of the KubeCon conference.
The European Commission has partially addressed these concerns. Only open-source software offered for commercial use falls under the CRA. For non-commercial software, ‘stewards’ will henceforth be appointed to support the development of open-source software.
Data Act: A European Patriot Act?
The Data Act is more recent, with a ‘birth date’ of January 2024. A year after the first wave of rules, new obligations have been applicable since September 12. The Data Act is intended to give citizens and customers of software and cloud providers more control over their data and was partly established through heavy lobbying by industry organizations.
The new obligations apply primarily to manufacturers of IoT devices, or all ‘connected products’, which must also comply with the CRA. They must now provide users with direct access to their data. Initially, manufacturers were required to provide this upon request, but this detour will no longer be permitted. This also includes metadata necessary to interpret the data.
The legislation will also change a lot for cloud providers. The Data Act aims to provide customers with an ‘exit route’ from cloud environments. Cloud providers may no longer obstruct the release of customer data and/or charge extra fees for this. These ‘fair contractual terms’ will formally take effect next year on September 12, 2025.
However, the Data Act also provides a mechanism whereby governments can compel companies to release specific data in emergency situations. You could call this the European version of the American Patriot Act could. The much-discussed Cloud Act emerged from that legislation, forming the breeding ground for the sovereignty debate in Europe.
‘Catch-all legislation’
Christoph Balduck, CTO of the Belgian data and AI compliance company Data Trust Associates, calls the Data Act ‘catch-all legislation’. The Data Act is a compilation of elements from smaller pieces of legislation that have been merged into one overarching framework. According to Balduck, the main guidelines are useful for citizens and companies, but only a small portion is aware of them.
“The Data Act provides Belgian companies with many advantages in terms of data and cloud platforms, contractual terms, their position relative to major cloud providers, easier data exchange, and access to a lot of useful data. This opens the door for new startups and better services,” Balduck said in a response.
“The fact that you can now finally collect data from smart devices in your home or office building largely automatically gives you many more possibilities. However, you must be careful about who you entrust that data to. Not every party has your best interests at heart, and advertising companies are eager to get their hands on it,” he added.
The Data Act gives Belgian companies many advantages in their position relative to large cloud providers.
Christoph Balduck, CTO & Managing Partner Data Trust Associates