Appendix B
BLegal basis
Each of the eight device functions in Section 2 is set out in specific articles or annex points of up to four acts (Table 22).
| Device function | Act | Provision |
|---|---|---|
| Firmware integrity (secure boot) | CRA | Annex I Part I (2)(f), (k) |
| RED (Reg. 2022/30) | Art. 3(3)(d) via EN 18031-1 | |
| Machinery Regulation | Annex III 1.1.9 | |
| Update mechanism and support period | CRA | Annex I Part I (2)(c); Part II (7), (8); Art. 13(8), (9) |
| Machinery Regulation | Annex III 1.2.1(f): log of safety-software versions | |
| Software bill of materials (SBOM) | CRA | Annex I Part II (1) |
| Machinery Regulation | Annex III 1.1.9: list of safety-relevant software | |
| Vulnerability handling and reporting | CRA | Annex I Part II (2)-(6); Art. 14 |
| Authentication, no blank passwords | CRA | Annex I Part I (2)(b), (d) |
| RED (Reg. 2022/30) | EN 18031 restriction on clauses 6.2.5.1/6.2.5.2 | |
| Data Act | Access “securely” (Art. 3(1)) | |
| Machinery Regulation | Annex III 1.1.9 | |
| Data export interface | CRA | Annex I Part I (2)(m): secure transfer |
| Data Act | Art. 3(1), 3(2), 4, 5 | |
| Batteries Regulation | Art. 77: passport data | |
| Logging of interventions and access | CRA | Annex I Part I (2)(d), (l) |
| Machinery Regulation | Annex III 1.1.9; 1.2.1(f): 5-year tracing log | |
| Product identification | CRA | Annex II (3), (7) |
| Data Act | Art. 3(2) | |
| Machinery Regulation | Annex III 1.1.9 | |
| Batteries Regulation | Art. 13(6): QR code |
Sources in this chapter6
Numbered as in the full reference list and the PDF.
- [141] European Commission. (2022). Commission Delegated Regulation (EU) 2022/30 supplementing Directive 2014/53/EU (RED) with regard to cybersecurity. https://eur-lex.europa.eu/eli/reg_del/2022/30/oj
- [148] European Commission. (2025). Commission Implementing Decision (EU) 2025/138 amending Implementing Decision (EU) 2022/2191 as regards harmonised standards for cybersecurity of radio equipment. http://data.europa.eu/eli/dec_impl/2025/138/oj
- [168] European Parliament and Council. (2023). Regulation (EU) 2023/1230 on machinery (Machinery Regulation). https://eur-lex.europa.eu/eli/reg/2023/1230/oj
- [169] European Parliament and Council. (2023). Regulation (EU) 2023/1542 concerning batteries and waste batteries (battery passport). https://eur-lex.europa.eu/eli/reg/2023/1542/oj
- [170] European Parliament and Council. (2023). Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (Data Act). https://eur-lex.europa.eu/eli/reg/2023/2854/oj
- [171] European Parliament and Council. (2024). Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act). https://eur-lex.europa.eu/eli/reg/2024/2847/oj