The text on a date

The publisher's dates this site holds for this act

• Entry into force: 2024-12-10 (the publisher's qualifier, word for word: DATPUB +20 V ART 71.1)
• Application: 2026-06-11 (the publisher's qualifier, word for word: MA/PART V ART 71.2)
• Application: 2026-09-11 (the publisher's qualifier, word for word: MA/PART V ART 71.2)
• Application: 2027-12-11 (the publisher's qualifier, word for word: V ART 71.2)
• Deadline: 2028-09-11 (the publisher's qualifier, word for word: V ART 70.2)
• Deadline: 2029-12-10 (the publisher's qualifier, word for word: V ART 61.2)
• Deadline: 2030-12-11 (the publisher's qualifier, word for word: B-19.12 V ART 70.1)

Not held for this act: end of validity. The publisher's dated statements this site holds for it give no such date, which says nothing of whether the act has one.

None of the dates above is used to choose a wording: each wording below carries its own date.

32024R2847, eng, the original wording of 2024-10-23 (the act's date in the publisher's Formex package)

This wording answers the dates from 2024-10-23 to the day before 2024-11-20, the date of the next wording.

/eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng

71 articles quoted, 0 held without text.

Page 2 of 2: Article 36 to Article 71.

36. 036 Article 36

    Article 36 Notifying authorities 1. Each Member State shall designate a notifying authority that shall be responsible for setting up and carrying out the necessary procedures for the assessment, designation and notification of conformity assessment bodies and their monitoring, including compliance with Article 41. 2. Member States may decide that the assessment and monitoring referred to in paragraph 1 shall be carried out by a national accreditation body within the meaning of and in accordance with Regulation (EC) No 765/2008. 3. Where the notifying authority delegates or otherwise entrusts the assessment, notification or monitoring referred to in paragraph 1 of this Article to a body which is not a governmental entity, that body shall be a legal entity and shall comply mutatis mutandis with Article 37. In addition, it shall have arrangements in place to cover liabilities arising from its activities. 4. The notifying authority shall take full responsibility for the tasks performed by the body referred to in paragraph 3.

    Text digest 1ad6ffb60e0b1cc14c09b1f36f85d009cb13c1b7a04d71f2061f313077c181e9, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/036

37. 037 Article 37

    Article 37 Requirements relating to notifying authorities 1. A notifying authority shall be established in such a way that no conflict of interest with conformity assessment bodies occurs. 2. A notifying authority shall be organised and shall function so as to safeguard the objectivity and impartiality of its activities. 3. A notifying authority shall be organised in such a way that each decision relating to notification of a conformity assessment body is taken by competent persons different from those who carried out the assessment. 4. A notifying authority shall not offer or provide any activities that conformity assessment bodies perform or consultancy services on commercial or competitive basis. 5. A notifying authority shall safeguard the confidentiality of the information it obtains. 6. A notifying authority shall have a sufficient number of competent personnel at its disposal for the proper performance of its tasks.

    Text digest df2ea3d2167a6c9e92d0d9a8ef30ca47040cb48203763a6b4ef311aee228ba63, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/037

38. 038 Article 38

    Article 38 Information obligation on notifying authorities 1. Member States shall inform the Commission of their procedures for the assessment and notification of conformity assessment bodies and the monitoring of notified bodies, and of any changes thereto. 2. The Commission shall make the information referred to in paragraph 1 publicly available.

    Text digest af2d1af964001c958995bc07f52706bb51fdea7fb5b3a9fecb4ce18261d7c532, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/038

39. 039 Article 39

    Article 39 Requirements relating to notified bodies 1. For the purposes of notification, a conformity assessment body shall meet the requirements laid down in paragraphs 2 to 12. 2. A conformity assessment body shall be established under national law and have legal personality. 3. A conformity assessment body shall be a third-party body independent of the organisation or the product with digital elements it assesses. A body belonging to a business association or professional federation representing undertakings involved in the design, development, production, provision, assembly, use or maintenance of products with digital elements which it assesses, may, on condition that its independence and the absence of any conflict of interest are demonstrated, be considered to be such a third-party body. 4. A conformity assessment body, its top level management and the personnel responsible for carrying out the conformity assessment tasks shall not be the designer, developer, manufacturer, supplier, importer, distributor, installer, purchaser, owner, user or maintainer of the products with digital elements which they assess, nor the authorised representative of any of those parties. This shall not preclude the use of assessed products that are necessary for the operations of the conformity assessment body or the use of such products for personal purposes. A conformity assessment body, its top level management and the personnel responsible for carrying out the conformity assessment tasks shall not be directly involved in the design, development, production, import, distribution, the marketing, installation, use or maintenance of the products with digital elements which they assess, or represent the parties engaged in those activities. They shall not engage in any activity that may conflict with their independence of judgement or integrity in relation to conformity assessment activities for which they are notified. This shall in particular apply to consultancy services. Conformity assessment bodies shall ensure that the activities of their subsidiaries or subcontractors do not affect the confidentiality, objectivity or impartiality of their conformity assessment activities. 5. Conformity assessment bodies and their personnel shall carry out the conformity assessment activities with the highest degree of professional integrity and the requisite technical competence in the specific field and shall be free from all pressures and inducements, particularly financial, which might influence their judgement or the results of their conformity assessment activities, especially as regards persons or groups of persons with an interest in the results of those activities. 6. A conformity assessment body shall be capable of carrying out all the conformity assessment tasks referred to in Annex VIII and in relation to which it has been notified, regardless of whether those tasks are carried out by the conformity assessment body itself or on its behalf and under its responsibility. At all times and for each conformity assessment procedure and each kind or category of products with digital elements in relation to which it has been notified, a conformity assessment body shall have at its disposal the necessary: (a) personnel with technical knowledge and sufficient and appropriate experience to perform the conformity assessment tasks; (b) descriptions of procedures in accordance with which conformity assessment is to be carried out, ensuring the transparency of and ability to reproduce those procedures. It shall have appropriate policies and procedures in place that distinguish between tasks it carries out as a notified body and other activities; (c) procedures for the performance of activities which take due account of the size of an undertaking, the sector in which it operates, its structure, the degree of complexity of the product technology in question and the mass or serial nature of the production process. A conformity assessment body shall have the means necessary to perform the technical and administrative tasks connected with the conformity assessment activities in an appropriate manner and shall have access to all necessary equipment or facilities. 7. The personnel responsible for carrying out conformity assessment activities shall have the following: (a) sound technical and vocational training covering all the conformity assessment activities in relation to which the conformity assessment body has been notified; (b) satisfactory knowledge of the requirements of the assessments they carry out and adequate authority to carry out those assessments; (c) appropriate knowledge and understanding of the essential cybersecurity requirements set out in Annex I, of the applicable harmonised standards and common specifications, and of the relevant provisions of Union harmonisation legislation and implementing acts; (d) the ability to draw up certificates, records and reports demonstrating that assessments have been carried out. 8. The impartiality of the conformity assessment bodies, their top level management and of the assessment personnel shall be guaranteed. The remuneration of the top level management and assessment personnel of a conformity assessment body shall not depend on the number of assessments carried out or on the results of those assessments. 9. Conformity assessment bodies shall take out liability insurance unless liability is assumed by their Member State in accordance with national law, or the Member State itself is directly responsible for the conformity assessment. 10. The personnel of a conformity assessment body shall observe professional secrecy with regard to all information obtained in carrying out their tasks under Annex VIII or any provision of national law giving effect to it, except in relation to the market surveillance authorities of the Member State in which its activities are carried out. Proprietary rights shall be protected. The conformity assessment body shall have documented procedures ensuring compliance with this paragraph. 11. Conformity assessment bodies shall participate in, or ensure that their assessment personnel are informed of, the relevant standardisation activities and the activities of the notified body coordination group established under Article 51 and apply as general guidance the administrative decisions and documents produced as a result of the work of that group. 12. Conformity assessment bodies shall operate in accordance with a set of consistent, fair, proportionate and reasonable terms and conditions, while avoiding unnecessary burden for economic operators, in particular taking into account the interests of microenterprises and small and medium-sized enterprises in relation to fees.

    Text digest 816281548719a998e813eb4d70db17348592f5df8f8b605d54dde9d4759b06ba, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/039

40. 040 Article 40

    Article 40 Presumption of conformity of notified bodies Where a conformity assessment body demonstrates its conformity with the criteria laid down in the relevant harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union it shall be presumed to comply with the requirements set out in Article 39 in so far as the applicable harmonised standards cover those requirements.

    Text digest ae1c482dd148fc92994f31fa4613559cd6ebc8c7ce768780ae28008474bdf36a, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/040

41. 041 Article 41

    Article 41 Subsidiaries of and subcontracting by notified bodies 1. Where a notified body subcontracts specific tasks connected with conformity assessment or has recourse to a subsidiary, it shall ensure that the subcontractor or the subsidiary meets the requirements set out in Article 39 and shall inform the notifying authority accordingly. 2. Notified bodies shall take full responsibility for the tasks performed by subcontractors or subsidiaries wherever they are established. 3. Activities may be subcontracted or carried out by a subsidiary only with the agreement of the manufacturer. 4. Notified bodies shall keep at the disposal of the notifying authority the relevant documents concerning the assessment of the qualifications of the subcontractor or the subsidiary and the work carried out by them under this Regulation.

    Text digest 15b524273ed0981c63642ed42f0c5a72aa7f7eec9be0a3e2902f34722c754846, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/041

42. 042 Article 42

    Article 42 Application for notification 1. A conformity assessment body shall submit an application for notification to the notifying authority of the Member State in which it is established. 2. That application shall be accompanied by a description of the conformity assessment activities, the conformity assessment procedure or procedures and the product or products with digital elements for which that body claims to be competent, as well as, where applicable, by an accreditation certificate issued by a national accreditation body attesting that the conformity assessment body fulfils the requirements laid down in Article 39. 3. Where the conformity assessment body concerned cannot provide an accreditation certificate, it shall provide the notifying authority with all the documentary evidence necessary for the verification, recognition and regular monitoring of its compliance with the requirements laid down in Article 39.

    Text digest 1c92fa3e9dc139a6d5c05dc7453995c59bd56c371975a5ef370c534a27ed1fc3, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/042

43. 043 Article 43

    Article 43 Notification procedure 1. Notifying authorities shall notify only conformity assessment bodies which have satisfied the requirements laid down in Article 39. 2. The notifying authority shall notify the Commission and the other Member States using the New Approach Notified and Designated Organisations information system developed and managed by the Commission. 3. The notification shall include full details of the conformity assessment activities, the conformity assessment module or modules and product or products with digital elements concerned and the relevant attestation of competence. 4. Where a notification is not based on an accreditation certificate as referred to in Article 42(2), the notifying authority shall provide the Commission and the other Member States with documentary evidence which attests to the conformity assessment body’s competence and the arrangements in place to ensure that that body will be monitored regularly and will continue to satisfy the requirements laid down in Article 39. 5. The body concerned may perform the activities of a notified body only where no objections are raised by the Commission or the other Member States within two weeks of a notification where an accreditation certificate is used or within two months of a notification where accreditation is not used. Only such a body shall be considered to be a notified body for the purposes of this Regulation. 6. The Commission and the other Member States shall be notified of any subsequent relevant changes to the notification.

    Text digest 5d4de579e2c24c578c0ef76bc6d697ab66b903eae863b16ad78c894912a193d1, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/043

44. 044 Article 44

    Article 44 Identification numbers and lists of notified bodies 1. The Commission shall assign an identification number to a notified body. It shall assign a single such number even where the body is notified under several Union legal acts. 2. The Commission shall make publicly available the list of the bodies notified under this Regulation, including the identification numbers that have been allocated to them and the activities for which they have been notified. The Commission shall ensure that that list is kept up to date.

    Text digest 27125cbc18cfa88e9341c292e59a4129178a5a18eb8576355b0c1f9fb0b33f53, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/044

45. 045 Article 45

    Article 45 Changes to notifications 1. Where a notifying authority has ascertained or has been informed that a notified body no longer meets the requirements laid down in Article 39, or that it is failing to fulfil its obligations, the notifying authority shall restrict, suspend or withdraw notification as appropriate, depending on the seriousness of the failure to meet those requirements or fulfil those obligations. It shall immediately inform the Commission and the other Member States accordingly. 2. In the event of restriction, suspension or withdrawal of notification, or where the notified body has ceased its activity, the notifying Member State shall take appropriate steps to ensure that the files of that body are either processed by another notified body or kept available for the responsible notifying and market surveillance authorities at their request.

    Text digest 17c3bfa4ea3a0478881948a6f582bea618fb2e17327109aab3dfad3d32b684eb, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/045

46. 046 Article 46

    Article 46 Challenge of the competence of notified bodies 1. The Commission shall investigate all cases where it doubts, or where doubt is brought to its attention regarding, the competence of a notified body to meet, or the continued fulfilment by a notified body of, the requirements and responsibilities to which it is subject. 2. The notifying Member State shall provide the Commission, on request, with all information relating to the basis for the notification or the maintenance of the competence of the body concerned. 3. The Commission shall ensure that all sensitive information obtained in the course of its investigations is treated confidentially. 4. Where the Commission ascertains that a notified body does not meet or no longer meets the requirements for its notification, it shall inform the notifying Member State accordingly and request it to take the necessary corrective measures, including de-notification if necessary.

    Text digest 5f803207a58878924378c0d0d019c37f1c4d6b8c0f4d49f4c2e72091150a8aa2, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/046

47. 047 Article 47

    Article 47 Operational obligations of notified bodies 1. Notified bodies shall carry out conformity assessments in accordance with the conformity assessment procedures provided for in Article 32 and Annex VIII. 2. Conformity assessments shall be carried out in a proportionate manner, avoiding unnecessary burdens for economic operators. Conformity assessment bodies shall perform their activities taking due account of the size of undertakings, in particular as regards microenterprises and small and medium-sized enterprises, the sector in which they operate, their structure, their degree of complexity and the cybersecurity risk level of the products with digital elements and technology in question and the mass or serial nature of the production process. 3. Notified bodies shall however respect the degree of rigour and the level of protection required for the compliance of products with digital elements with this Regulation. 4. Where a notified body finds that the requirements set out in Annex I or in corresponding harmonised standards or common specifications as referred to in Article 27 have not been met by a manufacturer, it shall require that manufacturer to take appropriate corrective measures and shall not issue a certificate of conformity. 5. Where, in the course of the monitoring of conformity following the issuance of a certificate, a notified body finds that a product with digital elements no longer complies with the requirements laid down in this Regulation, it shall require the manufacturer to take appropriate corrective measures and shall suspend or withdraw the certificate if necessary. 6. Where corrective measures are not taken or do not have the required effect, the notified body shall restrict, suspend or withdraw any certificates, as appropriate.

    Text digest 286195905e31f1b23506648cb3371562d7427aa41b0fd05a35c30ee16a5a8c4a, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/047

48. 048 Article 48

    Article 48 Appeal against decisions of notified bodies Member States shall ensure that an appeal procedure against decisions of the notified bodies is available.

    Text digest 837dbe13a9c486794bcdbf8f42f0e6017976a1cca67d2d75526ea39624c943c2, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/048

49. 049 Article 49

    Article 49 Information obligation on notified bodies 1. Notified bodies shall inform the notifying authority of the following: (a) any refusal, restriction, suspension or withdrawal of a certificate; (b) any circumstances affecting the scope of and conditions for notification; (c) any request for information which they have received from market surveillance authorities regarding conformity assessment activities; (d) on request, conformity assessment activities performed within the scope of their notification and any other activity performed, including cross-border activities and subcontracting. 2. Notified bodies shall provide the other bodies notified under this Regulation carrying out similar conformity assessment activities covering the same products with digital elements with relevant information on issues relating to negative and, upon request, positive conformity assessment results.

    Text digest 5ad819b2ee14a54241585dbf8d68d282226d06f0c902c5243a5ea7c09ee89020, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/049

50. 050 Article 50

    Article 50 Exchange of experience The Commission shall provide for the organisation of the exchange of experience between the Member States’ national authorities responsible for notification policy.

    Text digest ad35c8b806895cd97695a1006a05f851d551259caba4f80c2f732154166f8376, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/050

51. 051 Article 51

    Article 51 Coordination of notified bodies 1. The Commission shall ensure that appropriate coordination and cooperation between notified bodies are put in place and properly operated in the form of a cross-sectoral group of notified bodies. 2. Member States shall ensure that the bodies notified by them participate in the work of that group, directly or by means of designated representatives.

    Text digest ca4946a9a03f2c22e41db222840d236acde48ec54ea8b5ed603e4d031032c4f5, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/051

52. 052 Article 52

    Article 52 Market surveillance and control of products with digital elements in the Union market 1. Regulation (EU) 2019/1020 shall apply to products with digital elements that fall within the scope of this Regulation. 2. Each Member State shall designate one or more market surveillance authorities for the purpose of ensuring the effective implementation of this Regulation. Member States may designate an existing or new authority to act as market surveillance authority for this Regulation. 3. The market surveillance authorities designated under paragraph 2 of this Article shall also be responsible for carrying out market surveillance activities in relation to the obligations for open-source software stewards laid down in Article 24. Where a market surveillance authority finds that an open-source software steward does not comply with the obligations set out in that Article, it shall require the open-source software steward to ensure that all appropriate corrective actions are taken. Open-source software stewards shall ensure that all appropriate corrective action is taken in respect of their obligations under this Regulation. 4. Where relevant, the market surveillance authorities shall cooperate with the national cybersecurity certification authorities designated pursuant to Article 58 of Regulation (EU) 2019/881 and exchange information on a regular basis. With respect to the supervision of the implementation of the reporting obligations pursuant to Article 14 of this Regulation, the designated market surveillance authorities shall cooperate and exchange information on a regular basis with the CSIRTs designated as coordinators and ENISA. 5. The market surveillance authorities may request a CSIRT designated as coordinator or ENISA to provide technical advice on matters related to the implementation and enforcement of this Regulation. When conducting an investigation under Article 54, market surveillance authorities may request the CSIRT designated as coordinator or ENISA to provide an analysis to support evaluations of compliance of products with digital elements. 6. Where relevant, the market surveillance authorities shall cooperate with other market surveillance authorities designated on the basis of Union harmonisation legislation other than this Regulation, and exchange information on a regular basis. 7. Market surveillance authorities shall cooperate, as appropriate, with the authorities supervising Union data protection law. Such cooperation includes informing those authorities of any finding relevant for the fulfilment of their competences, including when issuing guidance and advice pursuant to paragraph 10 if such guidance and advice concerns the processing of personal data. Authorities supervising Union data protection law shall have the power to request and access any documentation created or maintained under this Regulation when access to that documentation is necessary for the fulfilment of their tasks. They shall inform the designated market surveillance authorities of the Member State concerned of any such request. 8. Member States shall ensure that the designated market surveillance authorities are provided with adequate financial and technical resources, including, where appropriate, processing automation tools, as well as with human resources with the necessary cybersecurity skills to fulfil their tasks under this Regulation. 9. The Commission shall encourage and facilitate the exchange of experience between designated market surveillance authorities. 10. Market surveillance authorities may provide guidance and advice to economic operators on the implementation of this Regulation, with the support of the Commission and, where appropriate, CSIRTs and ENISA. 11. Market surveillance authorities shall inform consumers of where to submit complaints that could indicate non-compliance with this Regulation, in accordance with Article 11 of Regulation (EU) 2019/1020, and shall provide information to consumers on where and how to access mechanisms to facilitate reporting of vulnerabilities, incidents and cyber threats that may affect products with digital elements. 12. Market surveillance authorities shall facilitate, where relevant, the cooperation with relevant stakeholders, including scientific, research and consumer organisations. 13. The market surveillance authorities shall report to the Commission on an annual basis the outcomes of relevant market surveillance activities. The designated market surveillance authorities shall report, without delay, to the Commission and relevant national competition authorities any information identified in the course of market surveillance activities that may be of potential interest for the application of Union competition law. 14. For products with digital elements that fall within the scope of this Regulation which are classified as high-risk AI systems pursuant to Article 6 of Regulation (EU) 2024/1689, the market surveillance authorities designated for the purposes of that Regulation shall be the authorities responsible for market surveillance activities required under this Regulation. The market surveillance authorities designated pursuant to Regulation (EU) 2024/1689 shall cooperate, as appropriate, with the market surveillance authorities designated pursuant to this Regulation and, with respect to the supervision of the implementation of the reporting obligations pursuant to Article 14 of this Regulation, with the CSIRTs designated as coordinators and ENISA. Market surveillance authorities designated pursuant to Regulation (EU) 2024/1689 shall in particular inform market surveillance authorities designated pursuant to this Regulation of any finding relevant for the fulfilment of their tasks in relation to the implementation of this Regulation. 15. ADCO shall be established for the uniform application of this Regulation, pursuant to Article 30(2) of Regulation (EU) 2019/1020. ADCO shall be composed of representatives of the designated market surveillance authorities and, if appropriate, representatives of single liaison offices. ADCO shall also address specific matters related to the market surveillance activities in relation to the obligations placed on open-source software stewards. 16. Market surveillance authorities shall monitor how manufacturers have applied the criteria referred to in Article 13(8) when determining the support period of their products with digital elements. ADCO shall publish in a publicly accessible and user-friendly form relevant statistics on categories of products with digital elements, including average support periods, as determined by the manufacturer pursuant to Article 13(8), as well as provide guidance that includes indicative support periods for categories of products with digital elements. Where the data suggests inadequate support periods for specific categories of products with digital elements, ADCO may issue recommendations to market surveillance authorities to focus their activities on such categories of products with digital elements.

    Text digest 5b090a190a3610fa3492ab30d81c113c75faa769e0f26980f76d7f23524a7ddf, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/052

53. 053 Article 53

    Article 53 Access to data and documentation Where necessary to assess the conformity of products with digital elements and the processes put in place by their manufacturers with the essential cybersecurity requirements set out in Annex I, the market surveillance authorities shall, upon a reasoned request, be granted access to the data, in a language easily understood by them, required to assess the design, development, production and vulnerability handling of such products, including related internal documentation of the relevant economic operator.

    Text digest 1ad653062c51d26af14628507bfe772dcb9435eaae62444f6dc4765969694256, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/053

54. 054 Article 54

    Article 54 Procedure at national level concerning products with digital elements presenting a significant cybersecurity risk 1. Where the market surveillance authority of a Member State has sufficient reason to consider that a product with digital elements, including its vulnerability handling, presents a significant cybersecurity risk, it shall, without undue delay and, where appropriate, in cooperation with the relevant CSIRT, carry out an evaluation of the product with digital elements concerned in respect of its compliance with all the requirements laid down in this Regulation. The relevant economic operators shall cooperate with the market surveillance authority as necessary. Where, in the course of that evaluation, the market surveillance authority finds that the product with digital elements does not comply with the requirements laid down in this Regulation, it shall without delay require the relevant economic operator to take all appropriate corrective actions to bring the product with digital elements into compliance with those requirements, to withdraw it from the market, or to recall it within a reasonable period, commensurate with the nature of the cybersecurity risk, as the market surveillance authority may prescribe. The market surveillance authority shall inform the relevant notified body accordingly. Article 18 of Regulation (EU) 2019/1020 shall apply to the corrective actions. 2. When determining the significance of a cybersecurity risk referred to in paragraph 1 of this Article, the market surveillance authorities shall also consider non-technical risk factors, in particular those established as a result of Union level coordinated security risk assessments of critical supply chains carried out in accordance with Article 22 of Directive (EU) 2022/2555. Where a market surveillance authority has sufficient reason to consider that a product with digital elements presents a significant cybersecurity risk in light of non-technical risk factors, it shall inform the competent authorities designated or established pursuant to Article 8 of Directive (EU) 2022/2555 and cooperate with those authorities as necessary. 3. Where the market surveillance authority considers that non-compliance is not restricted to its national territory, it shall inform the Commission and the other Member States of the results of the evaluation and of the actions which it has required the economic operator to take. 4. The economic operator shall ensure that all appropriate corrective action is taken in respect of all the products with digital elements concerned that it has made available on the market throughout the Union. 5. Where the economic operator does not take adequate corrective action within the period referred to in paragraph 1, second subparagraph, the market surveillance authority shall take all appropriate provisional measures to prohibit or restrict that product with digital elements from being made available on its national market, to withdraw it from that market or to recall it. That authority shall notify the Commission and the other Member States, without delay, of those measures. 6. The information referred to in paragraph 5 shall include all available details, in particular the data necessary for the identification of the non-compliant product with digital elements, the origin of that product with digital elements, the nature of the alleged non-compliance and the risk involved, the nature and duration of the national measures taken and the arguments put forward by the relevant economic operator. In particular, the market surveillance authority shall indicate whether the non-compliance is due to one or more of the following: (a) a failure of the product with digital elements or of the processes put in place by the manufacturer to meet the essential cybersecurity requirements set out in Annex I; (b) shortcomings in the harmonised standards, European cybersecurity certification schemes or common specifications, as referred to in Article 27. 7. The market surveillance authorities of the Member States other than the market surveillance authority of the Member State initiating the procedure shall without delay inform the Commission and the other Member States of any measures adopted and of any additional information at their disposal relating to the non-compliance of the product with digital elements concerned, and, in the event of disagreement with the notified national measure, of their objections. 8. Where, within three months of receipt of the notification referred to in paragraph 5 of this Article, no objection has been raised by either a Member State or the Commission in respect of a provisional measure taken by a Member State, that measure shall be deemed to be justified. This is without prejudice to the procedural rights of the economic operator concerned in accordance with Article 18 of Regulation (EU) 2019/1020. 9. The market surveillance authorities of all Member States shall ensure that appropriate restrictive measures are taken in respect of the product with digital elements concerned, such as withdrawal of that product from their market, without delay.

    Text digest bbc79130dc35426e018bf1bc5964084119ec81945013848b7041b7e8caa21911, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/054

55. 055 Article 55

    Article 55 Union safeguard procedure 1. Where, within three months of receipt of the notification referred to in Article 54(5), objections are raised by a Member State against a measure taken by another Member State, or where the Commission considers the measure to be contrary to Union law, the Commission shall without delay enter into consultation with the relevant Member State and the economic operator or operators and shall evaluate the national measure. On the basis of the results of that evaluation, the Commission shall decide whether the national measure is justified or not within nine months from the notification referred to in Article 54(5) and notify that decision to the Member State concerned. 2. If the national measure is considered to be justified, all Member States shall take the measures necessary to ensure that the non-compliant product with digital elements is withdrawn from their market, and shall inform the Commission accordingly. If the national measure is not considered to be justified, the Member State concerned shall withdraw the measure. 3. Where the national measure is considered to be justified and the non-compliance of the product with digital elements is attributed to shortcomings in the harmonised standards, the Commission shall apply the procedure provided for in Article 11 of Regulation (EU) No 1025/2012. 4. Where the national measure is considered to be justified and the non-compliance of the product with digital elements is attributed to shortcomings in a European cybersecurity certification scheme as referred to in Article 27, the Commission shall consider whether to amend or repeal any delegated act adopted pursuant to Article 27(9) that specifies the presumption of conformity concerning that certification scheme. 5. Where the national measure is considered to be justified and the non-compliance of the product with digital elements is attributed to shortcomings in common specifications as referred to in Article 27, the Commission shall consider whether to amend or repeal any implementing act adopted pursuant to Article 27(2) setting out those common specifications.

    Text digest 682700220fc1fc76e24032f0317e4c4c07fb5bb8b169500af9fa116747a18452, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/055

56. 056 Article 56

    Article 56 Procedure at Union level concerning products with digital elements presenting a significant cybersecurity risk 1. Where the Commission has sufficient reason to consider, including based on information provided by ENISA, that a product with digital elements that presents a significant cybersecurity risk does not comply with the requirements laid down in this Regulation, it shall inform the relevant market surveillance authorities. Where the market surveillance authorities carry out an evaluation of that product with digital elements that may present a significant cybersecurity risk in respect of its compliance with the requirements laid down in this Regulation, the procedures referred to in Articles 54 and 55 shall apply. 2. Where the Commission has sufficient reason to consider that a product with digital elements presents a significant cybersecurity risk in light of non-technical risk factors, it shall inform the relevant market surveillance authorities and, where appropriate, the competent authorities designated or established pursuant to Article 8 of Directive (EU) 2022/2555 and cooperate with those authorities as necessary. The Commission shall also consider the relevance of the identified risks for that product with digital elements in view of its tasks regarding the Union level coordinated security risk assessments of critical supply chains provided for in Article 22 of Directive (EU) 2022/2555, and consult, as necessary, the Cooperation Group established pursuant to Article 14 of Directive (EU) 2022/2555 and ENISA. 3. In circumstances which justify an immediate intervention to preserve the proper functioning of the internal market and where the Commission has sufficient reason to consider that the product with digital elements referred to in paragraph 1 remains non-compliant with the requirements laid down in this Regulation and no effective measures have been taken by the relevant market surveillance authorities, the Commission shall carry out an evaluation of compliance and may request ENISA to provide an analysis to support it. The Commission shall inform the relevant market surveillance authorities accordingly. The relevant economic operators shall cooperate with ENISA as necessary. 4. Based on the evaluation referred to in paragraph 3, the Commission may decide that a corrective or restrictive measure is necessary at Union level. To that end, it shall without delay consult the Member States concerned and the relevant economic operator or operators. 5. On the basis of the consultation referred to in paragraph 4 of this Article, the Commission may adopt implementing acts to provide for corrective or restrictive measures at Union level, including requiring the products with digital elements concerned to be withdrawn from the market or recalled, within a reasonable period, commensurate with the nature of the risk. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 62(2). 6. The Commission shall immediately communicate the implementing acts referred to in paragraph 5 to the relevant economic operator or operators. Member States shall implement those implementing acts without delay and shall inform the Commission accordingly. 7. Paragraphs 3 to 6 shall be applicable for the duration of the exceptional situation that justified the Commission’s intervention, provided that the product with digital elements concerned is not brought in compliance with this Regulation.

    Text digest 1a3637322f8c5c77204079342f4b6c3ba34620cf49a0b42b65fea911048cc56b, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/056

57. 057 Article 57

    Article 57 Compliant products with digital elements which present a significant cybersecurity risk 1. The market surveillance authority of a Member State shall require an economic operator to take all appropriate measures where, having performed an evaluation under Article 54, it finds that although a product with digital elements and the processes put in place by the manufacturer are in compliance with this Regulation, they present a significant cybersecurity risk as well as a risk to: (a) the health or safety of persons; (b) the compliance with obligations under Union or national law intended to protect fundamental rights; (c) the availability, authenticity, integrity or confidentiality of services offered using an electronic information system by essential entities as referred to in Article 3(1) of Directive (EU) 2022/2555; or (d) other aspects of public interest protection. The measures referred to in the first subparagraph may include measures to ensure that the product with digital elements concerned and the processes put in place by the manufacturer no longer present the relevant risks when made available on the market, withdrawal from the market of the product with digital elements concerned, or recalling of it, and shall be commensurate with the nature of those risks. 2. The manufacturer or other relevant economic operators shall ensure that corrective action is taken in respect of the products with digital elements concerned that they have made available on the market throughout the Union within the timeline established by the market surveillance authority of the Member State referred to in paragraph 1. 3. The Member State shall immediately inform the Commission and the other Member States about the measures taken pursuant to paragraph 1. That information shall include all available details, in particular the data necessary for the identification of the products with digital elements concerned, the origin and the supply chain of those products with digital elements, the nature of the risk involved and the nature and duration of the national measures taken. 4. The Commission shall without delay enter into consultation with the Member States and the relevant economic operator and shall evaluate the national measures taken. On the basis of the results of that evaluation, the Commission shall decide whether the measure is justified or not and, where necessary, propose appropriate measures. 5. The Commission shall address the decision referred to in paragraph 4 to the Member States. 6. Where the Commission has sufficient reason to consider, including based on information provided by ENISA, that a product with digital elements, although compliant with this Regulation, presents the risks referred to in paragraph 1 of this Article, it shall inform and may request the relevant market surveillance authority or authorities to carry out an evaluation and follow the procedures referred to in Article 54 and in paragraphs 1, 2 and 3 of this Article. 7. In circumstances which justify an immediate intervention to preserve the proper functioning of the internal market and where the Commission has sufficient reason to consider that the product with digital elements referred to in paragraph 6 continues to present the risks referred to in paragraph 1, and no effective measures have been taken by the relevant national market surveillance authorities, the Commission shall carry out an evaluation of the risks presented by that product with digital elements and may request ENISA to provide an analysis to support that evaluation and shall inform the relevant market surveillance authorities accordingly. The relevant economic operators shall cooperate with ENISA as necessary. 8. Based on the evaluation referred to in paragraph 7, the Commission may establish that a corrective or restrictive measure is necessary at Union level. To that end, it shall without delay consult the Member States concerned and the relevant economic operator or operators. 9. On the basis of the consultation referred to in paragraph 8 of this Article, the Commission may adopt implementing acts to decide on corrective or restrictive measures at Union level, including requiring the products with digital elements concerned to be withdrawn from the market, or recalled, within a reasonable period, commensurate with the nature of the risk. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 62(2). 10. The Commission shall immediately communicate the implementing acts referred to in paragraph 9 to the relevant economic operator or operators. Member States shall implement those implementing acts without delay and shall inform the Commission accordingly. 11. Paragraphs 6 to 10 shall apply for the duration of the exceptional situation that justified the Commission’s intervention and for as long as the product with digital elements concerned continues to present the risks referred to in paragraph 1.

    Text digest 04d408031177b696444cccf2bdf587a92921f19ee73e7d1a8a7bb8f8facf6f56, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/057

58. 058 Article 58

    Article 58 Formal non-compliance 1. Where the market surveillance authority of a Member State makes one of the following findings, it shall require the relevant manufacturer to put an end to the non-compliance concerned: (a) the CE marking has been affixed in violation of Articles 29 and 30; (b) the CE marking has not been affixed; (c) the EU declaration of conformity has not been drawn up; (d) the EU declaration of conformity has not been drawn up correctly; (e) the identification number of the notified body which is involved in the conformity assessment procedure, where applicable, has not been affixed; (f) the technical documentation is either not available or not complete. 2. Where the non-compliance referred to in paragraph 1 persists, the Member State concerned shall take all appropriate measures to restrict or prohibit the product with digital elements from being made available on the market or ensure that it is recalled or withdrawn from the market.

    Text digest bab061fdde92c425f5be085768ec5ee1c51580adc53f10c49ad90a713c617648, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/058

59. 059 Article 59

    Article 59 Joint activities of market surveillance authorities 1. Market surveillance authorities may agree with other relevant authorities to carry out joint activities aimed at ensuring cybersecurity and the protection of consumers with respect to specific products with digital elements placed on the market or made available on the market, in particular products with digital elements that are often found to present cybersecurity risks. 2. The Commission or ENISA shall propose joint activities for checking compliance with this Regulation to be conducted by market surveillance authorities based on indications or information of potential non-compliance across several Member States of products with digital elements that fall within the scope of this Regulation with the requirements laid down in this Regulation. 3. The market surveillance authorities and, where applicable, the Commission, shall ensure that the agreement to carry out joint activities does not lead to unfair competition between economic operators and does not negatively affect the objectivity, independence and impartiality of the parties to the agreement. 4. A market surveillance authority may use any information obtained as a result of the joint activities carried out as part of any investigation that it undertakes. 5. The market surveillance authority concerned and, where applicable, the Commission, shall make the agreement on joint activities, including the names of the parties involved, available to the public.

    Text digest 71295b102b6b70256e60e6c1706f5e4dc23394a176f4fa106ac53d65cf9a5ce0, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/059

60. 060 Article 60

    Article 60 Sweeps 1. Market surveillance authorities shall conduct simultaneous coordinated control actions (sweeps) of particular products with digital elements or categories thereof to check compliance with or to detect infringements to this Regulation. Those sweeps may include inspections of products with digital elements acquired under a cover identity. 2. Unless otherwise agreed upon by the market surveillance authorities involved, sweeps shall be coordinated by the Commission. The coordinator of the sweep shall, where appropriate, make the aggregated results publicly available. 3. Where, in the performance of its tasks, including based on the notifications received pursuant to Article 14(1) and (3), ENISA identifies categories of products with digital elements for which sweeps may be organised, it shall submit a proposal for a sweep to the coordinator referred to in paragraph 2 of this Article for the consideration of the market surveillance authorities. 4. When conducting sweeps, the market surveillance authorities involved may use the investigation powers set out in Articles 52 to 58 and any other powers conferred upon them by national law. 5. Market surveillance authorities may invite Commission officials, and other accompanying persons authorised by the Commission, to participate in sweeps.

    Text digest fce28965c0686f5d32553e4cdf570aed1681c200b9466742e328734c6effbc3a, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/060

61. 061 Article 61

    Article 61 Exercise of the delegation 1. The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article. 2. The power to adopt delegated acts referred to in Article 2(5), second subparagraph, Article 7(3), Article 8(1) and (2), Article 13(8), fourth subparagraph, Article 14(9), Article 25, Article 27(9), Article 28(5) and Article 31(5) shall be conferred on the Commission for a period of five years from 10 December 2024. The Commission shall draw up a report in respect of the delegation of power not later than nine months before the end of the five-year period. The delegation of power shall be tacitly extended for periods of an identical duration, unless the European Parliament or the Council opposes such extension not later than three months before the end of each period. 3. The delegation of power referred to in Article 2(5), second subparagraph, Article 7(3), Article 8(1) and (2), Article 13(8), fourth subparagraph, Article 14(9), Article 25, Article 27(9), Article 28(5) and Article 31(5) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force. 4. Before adopting a delegated act, the Commission shall consult experts designated by each Member State in accordance with principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making. 5. As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council. 6. A delegated act adopted pursuant to Article 2(5), second subparagraph, Article 7(3), Article 8(1) or (2), Article 13(8), fourth subparagraph, Article 14(9), Article 25, Article 27(9), Article 28(5) or Article 31(5) shall enter into force only if no objection has been expressed either by the European Parliament or by the Council within a period of two months of notification of that act to the European Parliament and to the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by two months at the initiative of the European Parliament or of the Council.

    Text digest 192354ef404964558b17eac437f56e9714fcdae14f73e0946398a7a4c43799db, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/061

62. 062 Article 62

    Article 62 Committee procedure 1. The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011. 2. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply. 3. Where the opinion of the committee is to be obtained by written procedure, that procedure shall be terminated without result when, within the time-limit for delivery of the opinion, the chair of the committee so decides or a committee member so requests.

    Text digest 386869257f1b0309eca78b9030752d3be684d04f6965f2b42bd0cd9886a758d8, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/062

63. 063 Article 63

    Article 63 Confidentiality 1. All parties involved in the application of this Regulation shall respect the confidentiality of information and data obtained in carrying out their tasks and activities in such a manner as to protect, in particular: (a) intellectual property rights and confidential business information or trade secrets of a natural or legal person, including source code, except the cases referred to in Article 5 of Directive (EU) 2016/943 of the European Parliament and of the Council; (b) the effective implementation of this Regulation, in particular for the purposes of inspections, investigations or audits; (c) public and national security interests; (d) integrity of criminal or administrative proceedings. 2. Without prejudice to paragraph 1, information exchanged on a confidential basis between the market surveillance authorities and between market surveillance authorities and the Commission shall not be disclosed without the prior agreement of the originating market surveillance authority. 3. Paragraphs 1 and 2 shall not affect the rights and obligations of the Commission, Member States and notified bodies with regard to the exchange of information and the dissemination of warnings, nor the obligations of the persons concerned to provide information under criminal law of the Member States. 4. The Commission and Member States may exchange, where necessary, sensitive information with relevant authorities of third countries with which they have concluded bilateral or multilateral confidentiality arrangements guaranteeing an adequate level of protection.

    Text digest fee6b9ef27daee56c0a15ddae6b7dc7611889e2631a4960b05f485fc43eb564e, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/063

64. 064 Article 64

    Article 64 Penalties 1. Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive. Member States shall, without delay, notify the Commission of those rules and measures and shall notify it, without delay, of any subsequent amendment affecting them. 2. Non-compliance with the essential cybersecurity requirements set out in Annex I and the obligations set out in Articles 13 and 14 shall be subject to administrative fines of up to EUR or, if the offender is an undertaking, up to % of the its total worldwide annual turnover for the preceding financial year, whichever is higher. 3. Non-compliance with the obligations set out in Articles 18 to 23, Article 28, Article 30(1) to (4), Article 31(1) to (4), Article 32(1), (2) and (3), Article 33(5), and Articles 39, 41, 47, 49 and 53 shall be subject to administrative fines of up to EUR or, if the offender is an undertaking, up to 2 % of its total worldwide annual turnover for the preceding financial year, whichever is higher. 4. The supply of incorrect, incomplete or misleading information to notified bodies and market surveillance authorities in reply to a request shall be subject to administrative fines of up to EUR or, if the offender is an undertaking, up to 1 % of its total worldwide annual turnover for the preceding financial year, whichever is higher. 5. When deciding on the amount of the administrative fine in each individual case, all relevant circumstances of the specific situation shall be taken into account and due regard shall be given to the following: (a) the nature, gravity and duration of the infringement and of its consequences; (b) whether administrative fines have been already applied by the same or other market surveillance authorities to the same economic operator for a similar infringement; (c) the size, in particular with regard to microenterprises and small and medium sized-enterprises, including start-ups, and the market share of the economic operator committing the infringement. 6. Market surveillance authorities that apply administrative fines shall communicate that application to the market surveillance authorities of other Member States through the information and communication system referred to in Article 34 of Regulation (EU) 2019/1020. 7. Each Member State shall lay down rules on whether and to what extent administrative fines may be imposed on public authorities and public bodies established in that Member State. 8. Depending on the legal system of the Member States, the rules on administrative fines may be applied in such a manner that the fines are imposed by competent national courts or other bodies according to the competences established at national level in those Member States. The application of such rules in those Member States shall have an equivalent effect. 9. Administrative fines may be imposed, depending on the circumstances of each individual case, in addition to any other corrective or restrictive measures applied by the market surveillance authorities for the same infringement. 10. By way of derogation from paragraphs 3 to 9, the administrative fines referred to in those paragraphs shall not apply to the following: (a) manufacturers that qualify as microenterprises or small enterprises with regard to any failure to meet the deadline referred to in Article 14(2), point (a), or Article 14(4), point (a); (b) any infringement of this Regulation by open-source software stewards.

    Text digest e5255f7a9d8d2561e6d5df0d5e248cbfcb2aa93355cab276583b51be90e85c8c, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/064

65. 065 Article 65

    Article 65 Representative actions Directive (EU) 2020/1828 shall apply to the representative actions brought against infringements by economic operators of provisions of this Regulation that harm, or may harm, the collective interests of consumers.

    Text digest fbf27adba6eab248c3dd221c120106f3e3c57b7912a66dccc24ae048548bfe84, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/065

66. 066 Article 66

    Article 66 Amendment to Regulation (EU) 2019/1020 In Annex I to Regulation (EU) 2019/1020, the following point is added: ‘72. Regulation (EU) 2024/2847 of the European Parliament and of the Council.

    Text digest 634a22a4bcf0899b4f677f0b1f871e9e6ef027beb0c14d9d22276e4c8329a047, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/066

67. 067 Article 67

    Article 67 Amendment to Directive (EU) 2020/1828 In Annex I to Directive (EU) 2020/1828, the following point is added: ‘69. Regulation (EU) 2024/2847 of the European Parliament and of the Council.

    Text digest 811484525388ed60918154fa432bcb5942eb22113fb84d7b10dfb75317e00a9b, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/067

68. 068 Article 68

    Article 68 Amendment to Regulation (EU) No 168/2013 In Part C1, in the table, of Annex II to Regulation (EU) No 168/2013 of the European Parliament and of the Council, the following entry is added: ‘ 1618protection of vehicle against cyberattacksxxxxxxxxxxxxxx ’.

    Text digest 550502b6deccd713ce049719632f03351594f3302307b692a3bd2da7b9e23a42, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/068

69. 069 Article 69

    Article 69 Transitional provisions 1. EU type-examination certificates and approval decisions issued regarding cybersecurity requirements for products with digital elements that are subject to Union harmonisation legislation other than this Regulation shall remain valid until 11 June 2028, unless they expire before that date, or unless otherwise specified in such other Union harmonisation legislation, in which case they shall remain valid as referred to in that legislation. 2. Products with digital elements that have been placed on the market before 11 December 2027 shall be subject to the requirements set out in this Regulation only if, from that date, those products are subject to a substantial modification. 3. By way of derogation from paragraph 2 of this Article, the obligations laid down in Article 14 shall apply to all products with digital elements that fall within the scope of this Regulation that have been placed on the market before 11 December 2027.

    Text digest 015946f45c4900fbf76accb51e965f206e5db302cba19598d8d0d1182a3cd603, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/069

70. 070 Article 70

    Article 70 Evaluation and review 1. By 11 December 2030 and every four years thereafter, the Commission shall submit a report on the evaluation and review of this Regulation to the European Parliament and to the Council. Those reports shall be made public. 2. By 11 September 2028, the Commission shall, after consulting ENISA and the CSIRTs network, submit a report to the European Parliament and to the Council, assessing the effectiveness of the single reporting platform set out in Article 16, as well as the impact of the application of the cybersecurity-related grounds referred to Article 16(2) by the CSIRTs designated as coordinators on the effectiveness of the single reporting platform as regards the timely dissemination of received notifications to other relevant CSIRTs.

    Text digest 1148bc73f878f5cb77cadfe84142842e0b8f20806e993b8f95004a13d669f086, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/070

71. 071 Article 71

    Article 71 Entry into force and application 1. This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. 2. This Regulation shall apply from 11 December 2027. However, Article 14 shall apply from 11 September 2026 and Chapter IV (Articles 35 to 51) shall apply from 11 June 2026.

    Text digest 1459c01453028f23adcfd572645b9d8a8096b5834fbc31b2c8bc7a5cf6bc0f58, body digest fe0cca4a0caec50e7cf5a91432b94a19b211f86be8584fdba56372bdcea571ed, official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02, /eu-eurlex/32024R2847/2024-10-23--c138a74c4029859595729bd84142b703dc4a18db7fa37cbe11085bc6466451bc/eng/071

8 annexes of the English wording are not served as text, and are never searched, quoted or exported: the annex could not be mapped to pages of the publisher PDF, so its body was not classified and its text is not served. Official source https://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.02.