Two parliamentary elections, two neck-and-neck races: In Finland, the Social Democrats led by Prime Minister Sanna Marin lost yesterday despite gains, and in Bulgaria (in the fifth election in two years), no winner had been determined even late in the evening. Read more in the news section.
German Chancellor Olaf Scholz is traveling to Romania today. During his visit to Ukraine’s neighbor, the security situation and the consequences of the war will be on the agenda. Scholz will also meet Moldovan President Maia Sandu in Bucharest – Moldova’s EU accession aspirations are likely to be a topic.
Today’s feature by my colleague Falk Steiner is about the Cyber Resilience Act. In September, the EU Commission presented a draft law that aims to strengthen the cybersecurity of devices connected to the Internet. Nicola Danti, the rapporteur in the EU Parliament, has now presented a first draft report. He wants to make changes, above all, to the timetable, the mandatory update period, the responsible bodies, and Open Source software.
I wish you interesting reading and a good start to the week.
With the Cyber Resilience Act, the EU wants to create a catch-all regulation for networked products not covered by more specific legislation. The Commission presented the CRA in September, and now Parliament is moving forward: Rapporteur Nicola Danti has sent the draft report to the shadow rapporteurs.
According to the Commission draft, a minimum guarantee for software updates is to be introduced, among other things. Here, the Italian Renew politician wants to oblige manufacturers to specify a “reasonable, expectable service life” of a product. To this end, they should also take sustainability aspects into account. Both the Commission and Danti propose a minimum service life of five years. During that period, vendors must offer cybersecurity-critical updates. Towards the end of the support period, the products or their manufacturers are to actively inform users about it.
However, Danti’s draft report also provides an exception. If products have a life expectancy shorter than five years and product support is discontinued before then, the providers would have to make the source code available to third parties. At the same time, Danti’s draft provides for strict regulations on who these third parties should be and under what conditions access should be possible. In addition, this obligation is to expire after five years.
There had been much criticism of the CRA from the ranks of Open Source developers. These could regularly not meet the CRA requirements. Freely available software could not pass through the intended and costly security testing mechanisms. Danti now wants to take an intermediate route here: The testing and update obligation is to be transferred to those who use Open Source software in their commercial products.
According to the EP rapporteur, home automation systems should additionally be included in the category of products to be certified externally. Self-certification by the manufacturers of these systems would then be ruled out. Instead, verification by third parties would have to take place in accordance with Article 6 of the Commission proposal. More and more households are home to such systems: from smart thermostats to electricity storage and household appliance controls.
A related option already exists today in Germany in the form of the voluntary IT security mark. However, only 37 services and products have been certified by the Federal Office for Information Security (BSI) since 2021. So far, these are exclusively mail services and broadband routers. However, according to the BSI, smart home terminal devices such as televisions, smart garden appliances, and home automation solutions are to follow soon.
The Commission proposal provides for a two-year transition period after the entry into force of the CRA in Article 57. ITRE Rapporteur Danti now wants to achieve a 40 months transition period. Danti also wants to extend the deadlines for the reporting obligations: they are to take effect 20 months after entry into force instead of twelve. And the Commission’s proposal already provided that products already on the market should not fall under the new regime. If the industry committee were to get its way here, an improvement in the level of IT security by the CRA could probably not be expected until 2028 at the earliest, and even then, for new products only.
Danti places a particular emphasis on the enforcement regime: he wants clear responsibility for all reporting obligations for security breaches and incidents. For the CRA to be effective, he wants a one-stop solution: “The Rapporteur believes that the best institution to perform this role is ENISA,” the draft report states. To this end, the network and information security authority is to be equipped with additional positions and competencies.
In doing so, however, the rapporteur touches on an old dispute. In many member states, cybersecurity is seen primarily as part of national security. Accordingly, competence is still mainly distributed nationally and ENISA has primarily coordinating functions. At present, experts do not yet see ENISA in a position to guarantee the expected significant effort to enforce the CRA.
What is extremely important to the rapporteur: With his Amendment 83, Danti wants to create a basis for harmonizing cybersecurity requirements with third countries. Danti wants to call on the Commission to create mutual recognition agreements with “like-minded” third countries.
In addition, international standards should be examined to see if they had “the same level of protection as those proposed in this regulation.” The rapporteur hopes these could be referenced for the planned harmonized European standards. However, there has been repeated criticism that Chinese players from the state, the state-controlled private sector, and academia not sufficiently removed from the state are becoming increasingly powerful in the relevant standardization bodies.
The Council’s vote on the Cyber Resilience Act is currently underway. Within the German government, the Federal Ministry of the Interior, which is also responsible for the BSI, is in charge. The BMWK and the BMUV are also involved. It is still unclear when an agreement on the CRA will be possible, both in the Council and in Parliament.
“The best thing about the proposal is that it now exists,” says René Repasi on the phone, shortly after the publication of the Commission’s draft for a Right to Repair. The SPD MEP is still visibly upset by the negative assessment of the Regulatory Scrutiny Board (RSB), which caused a significant delay. In an exchange in the Internal Market Committee (IMCO) with Justice Commissioner Didier Reynders a few days later, Repasi spoke of an “unnecessary holding pattern of half a year” and urged that the processing and negotiations be completed before the end of this legislative term.
On March 22, Reynders unveiled the proposal for the directive on common rules promoting the repair of goods, which is its correct title. This focuses on the service life of products. By contrast, the focus of the related Ecodesign Regulation is on the production phase while the Empowering consumers for a successful green transition Directive (both drafts were presented in March 2022) provides better information for consumers at the purchase of goods.
This is what the draft provides:
IMCO Chair Anna Cavazzini (Greens) says the draft’s approach of prioritizing product repair over replacement in the event of a defect is right. There are different views on this issue, she tells the committee, but from a climate and environmental protection perspective, this is the right approach. The consumer association BEUC, for example, is in favor of allowing consumers to decide between repair and replacement, as provided for in the current Sale of Goods Directive.
Cavazzini regrets that the Purchasing Directive will not be changed beyond that: according to the Commission’s proposal, there should be no extended warranty in the case of repair and no adjustment of the duration of the warranty to the expected lifetime of a product. However, Repasi explains, “If even one article of a directive is open, the whole directive is open.” He said this means that the Parliament could propose changes to other parts of the Sale of Goods Directive.
The biggest hurdle to repair remains the cost, Cavazzini criticized during the committee’s discussion. She said this is not sufficiently addressed in the draft. According to the proposed repair obligation for manufacturers, consumers would have to bear the costs of repair after the two-year warranty expires. Moreover, she said, this only applies to products for which there will be reparability requirements in other legislation, such as the Ecodesign Regulation. Cavazzini says an application to all products is preferable here.
“Determining the cost of repair is entirely at the discretion of the manufacturer, who – at least as the products are currently designed – has no real incentive to carry out repairs,” Repasi also criticizes in an interview with Table Media. A design aimed at improving the interchangeability of individual parts, such as batteries, would thus have a positive impact on costs.
Reynders points MEPs to the draft’s interplay with the Ecodesign Regulation and the Empowering consumers for a successful green transition Directive. For example, he said, sustainable product design is the first step and would also ultimately reduce the cost of replacement parts and repair.
Repasi also has concerns due to the proposed full harmonization of the directive. “That means that member states will no longer be allowed to deviate from what it says, for better or worse.” He fears that, as a consequence, measures that seek to incentivize the right to repair but are not covered by this directive would not be implemented.
Less harmonization, in this case, could give member states more leeway for further measures – there are more opportunities to test measures, he said. “Especially because this draft doesn’t even cover many elements that are actually needed for the right to repair to be purposeful.”
Some member states have already introduced measures that created incentives for repairs: Austria has offered a bonus of up to 200 euros for the repair of electrical appliances since last year, and France introduced a repair index at the beginning of 2021 that evaluates the reparability of smartphones, televisions, and three other product groups and makes them visible on a product label.
Another point of criticism from MEPs: the problem of early obsolescence of products. This is hardly addressed in the proposal, explained Tomislav Sokol (EPP), although some manufacturers deliberately shorten the lifespan of their products so that they break shortly after the warranty expires. In addition, there is also psychological obsolescence: the impression created by marketing strategies that a smartphone or laptop is obsolete and no longer usable without the latest update. Here, too, there are overlaps with the Ecodesign Regulation. It remains to be seen whether and where the problem can be addressed in a targeted manner, says Repasi.
Once Uta-Bettina von Altenbockum gets going, it is hard to stop her. Sustainable standards in the EU? “I would love to,” says the Head of the Sustainability and Communications Department at Deutsches Aktieninstitut, “but on a realistic scale, please.” Too often, she says, the EU’s ideas are all well and good but hard to implement. On a far too small-scale, far too bureaucratic, far too costly for companies.
“I understand that there is always a certain amount of time pressure when it comes to sustainability; everyone wants to act now,” says the 57-year-old. But if standards were “rushed through,” it would not do any good. Then the standards “ultimately would not provide the information we need to advance a transformation of the economy,” Altenbockum says.
She sees some evidence of this in the new EU sustainability reporting standards (ESRS) in particular: For example, she says there was a shortened consultation period, and the Sustainability Reporting Board (SRB) also had only ten weeks to evaluate extensive feedback from the consultation. Altenbockum would have liked it if the topics would not have been addressed all at once or at least presented in a reduced form.
That is why Deutsches Aktieninstitut, which has 200 members and covers 85 percent of the market capitalization of German listed companies, now wants to have its say. It created a sustainability department for the first time, with a reorganization a few months ago. Establishing one in 2023 is too late – and putting Altenbockum at the helm may well have different interpretations. On the one hand, the topic has finally arrived at the management level in the lobbying association. On the other hand, the issue has now a leader in charge of another area. Because she remains Head of Communications.
In the past, the issue of sustainability was mainly her responsibility, too, says the lawyer. In the press, however, she has rarely come up with far-reaching proposals on sustainability standards. In general, she takes a critical view of many regulatory projects – much like her employer. In its most recent statements, Deutsches Aktieninstitut called, among other things, for leaner reporting requirements for companies and considered consultation with European regulators on greenwashing to be “premature.”
That likely reflects the views of many companies, whose voice Altenbockum wants to strengthen as Head of Department. She says companies have been overwhelmed by political initiatives too often in recent years. She wants to rectify this and has thus already sought allies for her proposals in other associations. Altenbockum says they should have picked up a few European companies and carried out pilot projects with them instead of imposing all the regulations on companies.
In terms of argumentation, she is certainly liberal, but this is not overly surprising given her background. She originally started her career at the Sparkasse, then lived in Sweden, among other places, where she experienced stock returns and found them to be great. In the meantime, she earned a doctorate in law. But after a few years as a mother with her children, she thought it was time to return to the job market. When she made contact with the Aktieninstitut via two corners, she started as an intern, became a speaker, later Head of the Press Office, Head of Communications, and partly the face of the institute. Now she has to prove that the association can also play a role in the area of sustainability. At any rate, the new title is already in her e-mail signature – albeit in second place. Nils Wischmeyer
Two parliamentary elections, two neck-and-neck races: In Finland, the Social Democrats led by Prime Minister Sanna Marin lost yesterday despite gains, and in Bulgaria (in the fifth election in two years), no winner had been determined even late in the evening. Read more in the news section.
German Chancellor Olaf Scholz is traveling to Romania today. During his visit to Ukraine’s neighbor, the security situation and the consequences of the war will be on the agenda. Scholz will also meet Moldovan President Maia Sandu in Bucharest – Moldova’s EU accession aspirations are likely to be a topic.
Today’s feature by my colleague Falk Steiner is about the Cyber Resilience Act. In September, the EU Commission presented a draft law that aims to strengthen the cybersecurity of devices connected to the Internet. Nicola Danti, the rapporteur in the EU Parliament, has now presented a first draft report. He wants to make changes, above all, to the timetable, the mandatory update period, the responsible bodies, and Open Source software.
I wish you interesting reading and a good start to the week.
With the Cyber Resilience Act, the EU wants to create a catch-all regulation for networked products not covered by more specific legislation. The Commission presented the CRA in September, and now Parliament is moving forward: Rapporteur Nicola Danti has sent the draft report to the shadow rapporteurs.
According to the Commission draft, a minimum guarantee for software updates is to be introduced, among other things. Here, the Italian Renew politician wants to oblige manufacturers to specify a “reasonable, expectable service life” of a product. To this end, they should also take sustainability aspects into account. Both the Commission and Danti propose a minimum service life of five years. During that period, vendors must offer cybersecurity-critical updates. Towards the end of the support period, the products or their manufacturers are to actively inform users about it.
However, Danti’s draft report also provides an exception. If products have a life expectancy shorter than five years and product support is discontinued before then, the providers would have to make the source code available to third parties. At the same time, Danti’s draft provides for strict regulations on who these third parties should be and under what conditions access should be possible. In addition, this obligation is to expire after five years.
There had been much criticism of the CRA from the ranks of Open Source developers. These could regularly not meet the CRA requirements. Freely available software could not pass through the intended and costly security testing mechanisms. Danti now wants to take an intermediate route here: The testing and update obligation is to be transferred to those who use Open Source software in their commercial products.
According to the EP rapporteur, home automation systems should additionally be included in the category of products to be certified externally. Self-certification by the manufacturers of these systems would then be ruled out. Instead, verification by third parties would have to take place in accordance with Article 6 of the Commission proposal. More and more households are home to such systems: from smart thermostats to electricity storage and household appliance controls.
A related option already exists today in Germany in the form of the voluntary IT security mark. However, only 37 services and products have been certified by the Federal Office for Information Security (BSI) since 2021. So far, these are exclusively mail services and broadband routers. However, according to the BSI, smart home terminal devices such as televisions, smart garden appliances, and home automation solutions are to follow soon.
The Commission proposal provides for a two-year transition period after the entry into force of the CRA in Article 57. ITRE Rapporteur Danti now wants to achieve a 40 months transition period. Danti also wants to extend the deadlines for the reporting obligations: they are to take effect 20 months after entry into force instead of twelve. And the Commission’s proposal already provided that products already on the market should not fall under the new regime. If the industry committee were to get its way here, an improvement in the level of IT security by the CRA could probably not be expected until 2028 at the earliest, and even then, for new products only.
Danti places a particular emphasis on the enforcement regime: he wants clear responsibility for all reporting obligations for security breaches and incidents. For the CRA to be effective, he wants a one-stop solution: “The Rapporteur believes that the best institution to perform this role is ENISA,” the draft report states. To this end, the network and information security authority is to be equipped with additional positions and competencies.
In doing so, however, the rapporteur touches on an old dispute. In many member states, cybersecurity is seen primarily as part of national security. Accordingly, competence is still mainly distributed nationally and ENISA has primarily coordinating functions. At present, experts do not yet see ENISA in a position to guarantee the expected significant effort to enforce the CRA.
What is extremely important to the rapporteur: With his Amendment 83, Danti wants to create a basis for harmonizing cybersecurity requirements with third countries. Danti wants to call on the Commission to create mutual recognition agreements with “like-minded” third countries.
In addition, international standards should be examined to see if they had “the same level of protection as those proposed in this regulation.” The rapporteur hopes these could be referenced for the planned harmonized European standards. However, there has been repeated criticism that Chinese players from the state, the state-controlled private sector, and academia not sufficiently removed from the state are becoming increasingly powerful in the relevant standardization bodies.
The Council’s vote on the Cyber Resilience Act is currently underway. Within the German government, the Federal Ministry of the Interior, which is also responsible for the BSI, is in charge. The BMWK and the BMUV are also involved. It is still unclear when an agreement on the CRA will be possible, both in the Council and in Parliament.
“The best thing about the proposal is that it now exists,” says René Repasi on the phone, shortly after the publication of the Commission’s draft for a Right to Repair. The SPD MEP is still visibly upset by the negative assessment of the Regulatory Scrutiny Board (RSB), which caused a significant delay. In an exchange in the Internal Market Committee (IMCO) with Justice Commissioner Didier Reynders a few days later, Repasi spoke of an “unnecessary holding pattern of half a year” and urged that the processing and negotiations be completed before the end of this legislative term.
On March 22, Reynders unveiled the proposal for the directive on common rules promoting the repair of goods, which is its correct title. This focuses on the service life of products. By contrast, the focus of the related Ecodesign Regulation is on the production phase while the Empowering consumers for a successful green transition Directive (both drafts were presented in March 2022) provides better information for consumers at the purchase of goods.
This is what the draft provides:
IMCO Chair Anna Cavazzini (Greens) says the draft’s approach of prioritizing product repair over replacement in the event of a defect is right. There are different views on this issue, she tells the committee, but from a climate and environmental protection perspective, this is the right approach. The consumer association BEUC, for example, is in favor of allowing consumers to decide between repair and replacement, as provided for in the current Sale of Goods Directive.
Cavazzini regrets that the Purchasing Directive will not be changed beyond that: according to the Commission’s proposal, there should be no extended warranty in the case of repair and no adjustment of the duration of the warranty to the expected lifetime of a product. However, Repasi explains, “If even one article of a directive is open, the whole directive is open.” He said this means that the Parliament could propose changes to other parts of the Sale of Goods Directive.
The biggest hurdle to repair remains the cost, Cavazzini criticized during the committee’s discussion. She said this is not sufficiently addressed in the draft. According to the proposed repair obligation for manufacturers, consumers would have to bear the costs of repair after the two-year warranty expires. Moreover, she said, this only applies to products for which there will be reparability requirements in other legislation, such as the Ecodesign Regulation. Cavazzini says an application to all products is preferable here.
“Determining the cost of repair is entirely at the discretion of the manufacturer, who – at least as the products are currently designed – has no real incentive to carry out repairs,” Repasi also criticizes in an interview with Table Media. A design aimed at improving the interchangeability of individual parts, such as batteries, would thus have a positive impact on costs.
Reynders points MEPs to the draft’s interplay with the Ecodesign Regulation and the Empowering consumers for a successful green transition Directive. For example, he said, sustainable product design is the first step and would also ultimately reduce the cost of replacement parts and repair.
Repasi also has concerns due to the proposed full harmonization of the directive. “That means that member states will no longer be allowed to deviate from what it says, for better or worse.” He fears that, as a consequence, measures that seek to incentivize the right to repair but are not covered by this directive would not be implemented.
Less harmonization, in this case, could give member states more leeway for further measures – there are more opportunities to test measures, he said. “Especially because this draft doesn’t even cover many elements that are actually needed for the right to repair to be purposeful.”
Some member states have already introduced measures that created incentives for repairs: Austria has offered a bonus of up to 200 euros for the repair of electrical appliances since last year, and France introduced a repair index at the beginning of 2021 that evaluates the reparability of smartphones, televisions, and three other product groups and makes them visible on a product label.
Another point of criticism from MEPs: the problem of early obsolescence of products. This is hardly addressed in the proposal, explained Tomislav Sokol (EPP), although some manufacturers deliberately shorten the lifespan of their products so that they break shortly after the warranty expires. In addition, there is also psychological obsolescence: the impression created by marketing strategies that a smartphone or laptop is obsolete and no longer usable without the latest update. Here, too, there are overlaps with the Ecodesign Regulation. It remains to be seen whether and where the problem can be addressed in a targeted manner, says Repasi.
Once Uta-Bettina von Altenbockum gets going, it is hard to stop her. Sustainable standards in the EU? “I would love to,” says the Head of the Sustainability and Communications Department at Deutsches Aktieninstitut, “but on a realistic scale, please.” Too often, she says, the EU’s ideas are all well and good but hard to implement. On a far too small-scale, far too bureaucratic, far too costly for companies.
“I understand that there is always a certain amount of time pressure when it comes to sustainability; everyone wants to act now,” says the 57-year-old. But if standards were “rushed through,” it would not do any good. Then the standards “ultimately would not provide the information we need to advance a transformation of the economy,” Altenbockum says.
She sees some evidence of this in the new EU sustainability reporting standards (ESRS) in particular: For example, she says there was a shortened consultation period, and the Sustainability Reporting Board (SRB) also had only ten weeks to evaluate extensive feedback from the consultation. Altenbockum would have liked it if the topics would not have been addressed all at once or at least presented in a reduced form.
That is why Deutsches Aktieninstitut, which has 200 members and covers 85 percent of the market capitalization of German listed companies, now wants to have its say. It created a sustainability department for the first time, with a reorganization a few months ago. Establishing one in 2023 is too late – and putting Altenbockum at the helm may well have different interpretations. On the one hand, the topic has finally arrived at the management level in the lobbying association. On the other hand, the issue has now a leader in charge of another area. Because she remains Head of Communications.
In the past, the issue of sustainability was mainly her responsibility, too, says the lawyer. In the press, however, she has rarely come up with far-reaching proposals on sustainability standards. In general, she takes a critical view of many regulatory projects – much like her employer. In its most recent statements, Deutsches Aktieninstitut called, among other things, for leaner reporting requirements for companies and considered consultation with European regulators on greenwashing to be “premature.”
That likely reflects the views of many companies, whose voice Altenbockum wants to strengthen as Head of Department. She says companies have been overwhelmed by political initiatives too often in recent years. She wants to rectify this and has thus already sought allies for her proposals in other associations. Altenbockum says they should have picked up a few European companies and carried out pilot projects with them instead of imposing all the regulations on companies.
In terms of argumentation, she is certainly liberal, but this is not overly surprising given her background. She originally started her career at the Sparkasse, then lived in Sweden, among other places, where she experienced stock returns and found them to be great. In the meantime, she earned a doctorate in law. But after a few years as a mother with her children, she thought it was time to return to the job market. When she made contact with the Aktieninstitut via two corners, she started as an intern, became a speaker, later Head of the Press Office, Head of Communications, and partly the face of the institute. Now she has to prove that the association can also play a role in the area of sustainability. At any rate, the new title is already in her e-mail signature – albeit in second place. Nils Wischmeyer
