Cybersecurity legislation for connected machines

It ensures a single market for radio equipment by setting essential requirements for safety and health, electromagnetic compatibility, and the efficient use of the radio spectrum. It also provides the basis for further regulations by delegated acts adding additional legislation such as in this case for cybersecurity. 

Joe Lomako, Business Development Manager (IoT) at TÜV SÜD further explores.

It should be noted that in the UK, the requirements of the Radio Equipment Regulations 2017 are presently identical to the RED, and there is no plan to mirror any additional requirements in the RED.

Compliance with the RED is achieved by satisfying a number of ‘essential requirements’. The existing ones for Safety and Health, EMC and Radio are well known as the ‘original’ essential requirements. However, recently a delegated act was published activating new essential requirements with the details given in the following Articles in the RED, which the industry has collectively termed ‘cybersecurity’: 

• 3.3d: communicate over the Internet, either directly or via any other equipment
• 3.3e: process personal data, traffic data or location data
• 3.3f: enable users to transfer money, monetary value or virtual currency

It is important to note that these new requirements have not been replicated in the UK’s Radio Equipment Regulations.

These new RED provisions will become mandatory on 1st August 2025, which is an extension from the original date of 1st August 2024. Manufacturers of radio equipment, that is not compliant by that date, face potential action. The reason is that an increasing number of products, such as machinery, are employing radio technology in their applications. Many of these devices connect to the Internet, which could expose such products to increasing security threats and the potential to be attacked and exploited.

To help manufacturers comply with these essential requirements, the European Commission issued a ‘standards request’ to the European Standards Organizations (ESO), asking them to produce standards to assist in compliance. Further guidance is also expected from the Commission. The standards request sets out the minimum requirements, but the final standards may include further assessment criteria where appropriate, and further guidance could come from the Commission. 

What do the Essential Requirements Actually mean?

Article 3.3(d) – Protection of the network It covers radio equipment that can communicate directly through the Internet and radio equipment which can communicate over the Internet by way of another connected device. In simplistic terms, the radio product must not, nor be able to be compromised, thereby causing harm to the network.  

Article 3.3(e) – Privacy This requires radio equipment to incorporate safeguards to ensure that the personal data and privacy is secured. This includes but is not limited to radio equipment that can process personal, traffic and location data. 

Article 3.3(f) It will protect users who wish to use radio products to process financial transactions and protect them from compromise and fraud.

Compliance time

As compliance with the essential requirements becomes mandatory from 1st August 2025, the entire machinery supply chain (manufacturers, importers and integrators of radio equipment) has less than 12 months to ensure that internet connected radio devices incorporated into machinery adhere to the new provisions. This may require some significant adaptations to how radio-enabled machinery is manufactured and supplied. This time will go very quickly, so manufacturers should start including the new requirements into product technical specifications as early as possible. 

Next step in compliance

Although the RED is pioneering the way forward in Europe in mandating cybersecurity of connected devices, there is presently a proposal out for a new horizontal legislation - The Cyber Resilience Act (CRA). This proposal is for a regulation on cybersecurity requirements for products with digital elements. Although only a proposal, it is a significant step forward in improving the cybersecurity of products put on the market in Europe. The work being done on the RED though will not be lost as the requirements in the CRA include all the elements expected in the RED. The date of the final publication of the CRA is yet to be announced but is believed to be imminent.

As we continue to develop Industry 4.0-based production methods, increasingly complex and convergent technologies are being continuously introduced. This means that machines are increasingly incorporating radio-based components which rely on the radio spectrum to operate, so regulations such as the RED and CRA must be taken into account at the design stage.