Agent · cyberresiliens-2024-2847-54

Cyberresiliensakten artikel 54: Procedure at national level concerning products with digital elements presenting a significant cybersecurity risk

Strukturelt tre: artikkelens egne punkter, ordrett.

CELEX 32024R2847 · 2026-08-18 · Vekt 78 · minimal-risk

ExtendedOperational weight but lower priority. Metered by volume, not per call, once metering is switched on.

CyberresiliensaktenOffisiell kilde

Inndata

• in_scopeThe article applies to the situationboolean
• punktParagraph of the articleenum (1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14)

Regeltre

1. Hvis: alla(in_scope = true, punkt = 1)

   Paragraph 1 applies

   1. Where the market surveillance authority of a Member State has sufficient reason to consider that a product with digital elements, including its vulnerability handling, presents a significant cybersecurity risk, it shall, without undue delay and, where appropriate, in cooperation with the relevant CSIRT, carry out an evaluation of the product with digital elements concerned in respect of its compliance with all the…

   Punkt 1

2. Hvis: alla(in_scope = true, punkt = 2)

   Paragraph 2 applies

   Where, in the course of that evaluation, the market surveillance authority finds that the product with digital elements does not comply with the requirements laid down in this Regulation, it shall without delay require the relevant economic operator to take all appropriate corrective actions to bring the product with digital elements into compliance with those requirements, to withdraw it from the market, or to recal…

   Punkt 2

3. Hvis: alla(in_scope = true, punkt = 3)

   Paragraph 3 applies

   The market surveillance authority shall inform the relevant notified body accordingly. Article 18 of Regulation (EU) 2019/1020 shall apply to the corrective actions.

   Punkt 3

4. Hvis: alla(in_scope = true, punkt = 4)

   Paragraph 4 applies

   2. When determining the significance of a cybersecurity risk referred to in paragraph 1 of this Article, the market surveillance authorities shall also consider non-technical risk factors, in particular those established as a result of Union level coordinated security risk assessments of critical supply chains carried out in accordance with Article 22 of Directive (EU) 2022/2555. Where a market surveillance authority…

   Punkt 4

5. Hvis: alla(in_scope = true, punkt = 5)

   Paragraph 5 applies

   3. Where the market surveillance authority considers that non-compliance is not restricted to its national territory, it shall inform the Commission and the other Member States of the results of the evaluation and of the actions which it has required the economic operator to take.

   Punkt 5

6. Hvis: alla(in_scope = true, punkt = 6)

   Paragraph 6 applies

   4. The economic operator shall ensure that all appropriate corrective action is taken in respect of all the products with digital elements concerned that it has made available on the market throughout the Union.

   Punkt 6

7. Hvis: alla(in_scope = true, punkt = 7)

   Paragraph 7 applies

   5. Where the economic operator does not take adequate corrective action within the period referred to in paragraph 1, second subparagraph, the market surveillance authority shall take all appropriate provisional measures to prohibit or restrict that product with digital elements from being made available on its national market, to withdraw it from that market or to recall it.

   Punkt 7

8. Hvis: alla(in_scope = true, punkt = 8)

   Paragraph 8 applies

   That authority shall notify the Commission and the other Member States, without delay, of those measures.

   Punkt 8

9. Hvis: alla(in_scope = true, punkt = 9)

   Paragraph 9 applies

   6. The information referred to in paragraph 5 shall include all available details, in particular the data necessary for the identification of the non-compliant product with digital elements, the origin of that product with digital elements, the nature of the alleged non-compliance and the risk involved, the nature and duration of the national measures taken and the arguments put forward by the relevant economic opera…

   Punkt 9

10. Hvis: alla(in_scope = true, punkt = 10)

    Paragraph 10 applies

    (a)

    Punkt 10

11. Hvis: alla(in_scope = true, punkt = 11)

    Paragraph 11 applies

    a failure of the product with digital elements or of the processes put in place by the manufacturer to meet the essential cybersecurity requirements set out in Annex I;

    Punkt 11

12. Hvis: alla(in_scope = true, punkt = 12)

    Paragraph 12 applies

    (b)

    Punkt 12

13. Hvis: alla(in_scope = true, punkt = 13)

    Paragraph 13 applies

    shortcomings in the harmonised standards, European cybersecurity certification schemes or common specifications, as referred to in Article 27.

    Punkt 13

14. Hvis: alla(in_scope = true, punkt = 14)

    Paragraph 14 applies

    7. The market surveillance authorities of the Member States other than the market surveillance authority of the Member State initiating the procedure shall without delay inform the Commission and the other Member States of any measures adopted and of any additional information at their disposal relating to the non-compliance of the product with digital elements concerned, and, in the event of disagreement with the no…

    Punkt 14

Hvis ingen regel treffer: The article is not stated to apply, or no paragraph is selected. The agent abstains rather than guesses.

Artikkelteksten som ble lest

1. 11. Where the market surveillance authority of a Member State has sufficient reason to consider that a product with digital elements, including its vulnerability handling, presents a significant cybersecurity risk, it shall, without undue delay and, where appropriate, in cooperation with the relevant CSIRT, carry out an evaluation of the product with digital elements concerned in respect of its compliance with all the requirements laid down in this Regulation. The relevant economic operators shall cooperate with the market surveillance authority as necessary.
2. 2Where, in the course of that evaluation, the market surveillance authority finds that the product with digital elements does not comply with the requirements laid down in this Regulation, it shall without delay require the relevant economic operator to take all appropriate corrective actions to bring the product with digital elements into compliance with those requirements, to withdraw it from the market, or to recall it within a reasonable period, commensurate with the nature of the cybersecurity risk, as the market surveillance authority may prescribe.
3. 3The market surveillance authority shall inform the relevant notified body accordingly. Article 18 of Regulation (EU) 2019/1020 shall apply to the corrective actions.
4. 42. When determining the significance of a cybersecurity risk referred to in paragraph 1 of this Article, the market surveillance authorities shall also consider non-technical risk factors, in particular those established as a result of Union level coordinated security risk assessments of critical supply chains carried out in accordance with Article 22 of Directive (EU) 2022/2555. Where a market surveillance authority has sufficient reason to consider that a product with digital elements presents a significant cybersecurity risk in light of non-technical risk factors, it shall inform the competent authorities designated or established pursuant to Article 8 of Directive (EU) 2022/2555 and cooperate with those authorities as necessary.
5. 53. Where the market surveillance authority considers that non-compliance is not restricted to its national territory, it shall inform the Commission and the other Member States of the results of the evaluation and of the actions which it has required the economic operator to take.
6. 64. The economic operator shall ensure that all appropriate corrective action is taken in respect of all the products with digital elements concerned that it has made available on the market throughout the Union.
7. 75. Where the economic operator does not take adequate corrective action within the period referred to in paragraph 1, second subparagraph, the market surveillance authority shall take all appropriate provisional measures to prohibit or restrict that product with digital elements from being made available on its national market, to withdraw it from that market or to recall it.
8. 8That authority shall notify the Commission and the other Member States, without delay, of those measures.
9. 96. The information referred to in paragraph 5 shall include all available details, in particular the data necessary for the identification of the non-compliant product with digital elements, the origin of that product with digital elements, the nature of the alleged non-compliance and the risk involved, the nature and duration of the national measures taken and the arguments put forward by the relevant economic operator. In particular, the market surveillance authority shall indicate whether the non-compliance is due to one or more of the following:
10. 10(a)
11. 11a failure of the product with digital elements or of the processes put in place by the manufacturer to meet the essential cybersecurity requirements set out in Annex I;
12. 12(b)
13. 13shortcomings in the harmonised standards, European cybersecurity certification schemes or common specifications, as referred to in Article 27.
14. 147. The market surveillance authorities of the Member States other than the market surveillance authority of the Member State initiating the procedure shall without delay inform the Commission and the other Member States of any measures adopted and of any additional information at their disposal relating to the non-compliance of the product with digital elements concerned, and, in the event of disagreement with the notified national measure, of their objections.

Ingen rådgivning. Deterministisk regeluppslagning. Ingen juridisk rådgivning, inget efterlevnadsbeslut, ingen bedömning av ett enskilt ärende.

Sitering: 32024R2847 art. 54, Procedure at national level concerning products with digital elements presenting a significant cybersecurity risk. ExploreWorld Legal, https://legal.exploreworldai.com/agent/cyberresiliens-2024-2847/artikel-54 (hämtad 2026-08-18, bevis sha256:dde775a13163d177, bygge legal-2026-08-25).