More Pragmatism and Proportionality in the Cyber Resilience Act
As a member of the Federal Association IT-Mittelstand e.V. (BITMi), FLOWSTER supports the call for more pragmatism and proportionality in the Cyber Resilience Act (CRA). The BITMi is calling on the German government to reject the current version of the CRA in the EU Council of Ministers and to advocate for limiting the regulation to software that uses an internet connection.
BITMi President Dr. Oliver Grün criticizes the current version of the CRA as excessive and undifferentiated. Small and medium-sized enterprises (SMEs) in particular would be burdened by the high bureaucratic effort without creating significant benefit for cybersecurity. The association emphasizes the need for regulation that supports digital progress rather than hindering it.
FLOWSTER Solutions stands behind these demands and, together with BITMi, advocates for practical and proportionate regulation.
Below we have prepared the complete BITMi press release for you:
Cyber Resilience Act: BITMi Calls for More Pragmatism and Proportionality
Aachen, Berlin, May 24, 2024 – After the Cyber Resilience Act (CRA) was adopted in the European Parliament in March, final confirmation by the EU Council of Ministers is still pending. The Federal Association IT-Mittelstand e.V. (BITMi) is now calling on the German government to reject the current version of the CRA in the EU Council of Ministers and instead advocate for improvements with more pragmatism and proportionality. Specifically, the association recommends limiting the regulation to software that uses an internet connection to avoid over-regulation without increased benefit for cybersecurity.
From 2027, any software installed on an internet-enabled device will need to be provided with security updates for a period of at least five years and receive CE marking. However, the obligation to provide security updates to consumers has existed since January 1, 2022 based on existing EU legislation on digital products and goods sales. In this respect, the CRA offers neither an innovation nor an improvement.
European Digital Economy Further Weakened
At the same time, companies are subject to extensive documentation and design obligations without these leading to a qualitative improvement in software. In particular, software companies are required to create, store, and update several formal legal documents. A multitude of unclear formulations creates bureaucratic effort and legal uncertainty for companies, which will disproportionately burden SMEs and start-ups in particular. It is precisely these companies that make up the majority of the European digital economy. For them, the bureaucratic effort is increasingly becoming a crushing burden that ultimately prevents innovation. Technological sovereignty through digitalization "made in Europe" is difficult to achieve this way.
More Pragmatism and Proportionality Needed
The complexity and speed of digital progress require differentiated and prudent regulation. The CRA, however, sets blanket requirements for the design and documentation of software without requiring that the software itself maintains an internet connection or is used in a technically or privacy-sensitive area (operating system or fitness app). Even for an insignificant text editor, a cybersecurity assessment, formal technical documentation, user information, and a declaration of conformity must be created.
"In its current version of over 300 pages, the CRA is an example of excessive and undifferentiated regulation that puts obstacles in the way of small and medium-sized enterprises in particular. It also pushes the good goals and approaches, such as an obligation to report vulnerabilities, into the background. A simple text editor that doesn't even connect to the internet doesn't need a CE mark."– BITMi President Dr. Oliver Grün
The BITMi therefore calls on the German government to reject the current version of the CRA in the EU Council of Ministers and instead advocate for limiting applicability to software that uses an internet connection. This would ensure that the effort for companies and the benefit for more cybersecurity are in a more appropriate relationship to each other. This would also contribute to the German government's often-stated claim to reduce the bureaucratic burden, especially for SMEs, and to promote innovation in the local digital sector.
About the Federal Association IT-Mittelstand:
The Federal Association IT-Mittelstand e.V. (BITMi) represents over 2,500 companies in the digital economy and is thus the largest IT trade association exclusively for medium-sized interests in Germany.
More information: Federal Association IT-Mittelstand e.V. (BITMi)
Photo: Unsplash | Catrin Johnson