New 2027 Legislation on the Security of Digital Products

10 December 2024

New 2027 Legislation on the Security of Digital Products

Stelt u zich eens voor: u werkt al jaren met dezelfde zelfstandige. Hij stuurt facturen, factureert btw en heeft een eigen kvk-nummer. Toch krijgt u in 2026 ineens vragen van de Belastingdienst over de aard van uw samenwerking. Hoe heeft het zo ver kunnen komen?

The Cyber Resilience Act (CRA), published on 20 November 2024, is a European Regulation, comparable to the GDPR, and is therefore directly applicable in all EU member states. The regulation takes effect on 11 December 2027, with the exception of a few articles (the reporting obligation takes effect on 11 September 2026). Unlike the NIS2 Directive, the CRA is not limited to medium-sized and large companies.

This regulation focuses on the cybersecurity of products with digital elements, including AI. The goal? To strengthen the digital security of products and better protect consumers and businesses against cyber threats. In principle, all hardware and software will fall under the CRA, with the exception in principle of Software as a Service (SaaS), which does fall under NIS2.

The CRA imposes mandatory and essential cybersecurity requirements on manufacturers and distributors of products with digital components. According to the European Commission, the regulation provides:

Harmonization of rules for placing digital products and software on the market.
Mandatory cybersecurity requirements for all stages of the product lifecycle: from design to maintenance.
A duty of care that ensures security requirements are met throughout the entire lifespan of products.

Link with the EU AI Act
An important aspect of the CRA is its interaction with the EU AI Act, as set out in Article 12. AI systems classified as high-risk fall under specific provisions of both regulations:

Products that comply with the cybersecurity requirements of the CRA are deemed to also comply with the requirements of Article 15 of the EU AI Act.
High-risk AI systems that use internal control procedures (Article 43(2), EU AI Act) must additionally undergo the CRA’s conformity assessments.

What does this mean for organizations?
The CRA will become fully effective from 11 December 2027 and, like the GDPR and the EU AI Act, is a directly applicable EU regulation. This means companies in all member states are required to comply with the new requirements. For organizations developing AI systems or placing products with digital elements on the market, it is crucial to prepare now for this harmonization of cybersecurity rules.

With the Cyber Resilience Act, the EU is once again taking a major step in regulating digital security, and its impact on the AI sector should not be underestimated. This is, in any case, the moment to thoroughly review your own systems, products, and processes.

What can you do now?
Compliance with AI, cybersecurity, and data legislation is not only a legal obligation but also an opportunity for organizations to strengthen safe and responsible innovation and increase trust among customers and/or stakeholders.

The Legal Company’s business lawyers combine legal expertise with knowledge of technology when it comes to the action points above. Whether you are just starting out with AI or want to analyze your existing systems, we ensure that you are not only prepared for the regulations but also benefit from them strategically.

Don’t wait until the deadlines approach. Contact us today at info@thelegalcompany.nl or call 020 345 0152.

This article was published on 10 December 2024

De afgelopen jaren stonden in het teken van de Wet VBAR, het wetsvoorstel dat een einde moest maken aan onduidelijkheid over de zzp’er. Het kabinet heeft delen van dat voorstel inmiddels geschrapt. Op het eerste gezicht is dat goed nieuws: minder regels, minder administratieve last. Maar in de praktijk blijven dezelfde toetsen overeind.

“De inhoud van de samenwerking is leidend, niet wat er op papier staat.”

De Belastingdienst handhaaft sinds 1 januari 2025 weer actief op schijnzelfstandigheid. En recente uitspraken van de Hoge Raad bevestigen dat rechters strikt toetsen of er sprake is van ondergeschiktheid en gezagsverhouding.

Voor uw praktijk betekent dit drie dingen. Een: leg de samenwerking duidelijk vast, met aandacht voor de inhoud. Twee: voorkom dat een zzp’er feitelijk werkt als werknemer. Drie: wees voorbereid op een controle, en weet hoe u de relatie kunt herzien als dat moet.

Heeft u vragen over uw concrete situatie? Wij sparren dagelijks met opdrachtgevers over hun zzp-relaties. Vraag een offerte op of bekijk onze Legal Safe abonnementen.