European Electronic Companies Warn Of EU Cybersecurity Rules Potentially Disrupt Supply Chains

JAKARTA - European electronics companies such as Siemens, Ericsson, and Schneider Electric, along with industry group DigitalEurope, on Monday 6 November warned that proposed EU rules and targeted cybersecurity risks smart devices could disrupt supply chains on a scale similar to the pandemic.

Proposed by the European Commission last year, the Cyber Resilience Act requires manufacturers to assess the cybersecurity risks of their products. In addition, they are also asked to take steps to fix problems during the five-year period or during the expected service period of the product.

The proposed rules will also apply to internet-connected importers and distributors of devices. Cybersecurity concerns have spiked after a series of important incidents by hackers who damaged businesses and demanded a large ransom.

"The existing regulations risk creating a bottleneck that will disrupt a single market," the company's chief executive officer wrote in a joint letter to EU industry chief Thierry Breton and EU digital chief Vera Jourova.

They said the disruption could hit millions of products, from washing machines to toys, cybersecurity products, as well as essential components for hot pumps, cooling machines, and high-tech manufacturing. The delay may be due to a shortage of independent experts for assessment and bureaucracy, the companies said.

"We risk creating a COVID-style blockade in Europe's supply chain, disrupting single markets, and harming our competitiveness," the companies wrote.

Other signatures in the letter included the CEO of Nokia, Robert Bosch GmbH, and Slovak software company ESET.

The companies say a list of products with higher risk that comply with the rules should be significantly reduced, and that manufacturers should be allowed to improve the risk of known vulnerabilities rather than first assess.

They also want more flexibility to assess cybersecurity risks on their own.

The letter comes ahead of negotiations between EU countries and EU legislators on November 8 to formulate details of the draft law before it can be adopted.