Manufacturers should make their products with digital elements available on the market with a secure by default configuration and provide security updates to users free of charge. Manufacturers should only be able to deviate from the essential cybersecurity requirements in relation to tailor-made products that are fitted to a particular purpose for a particular business user and where both the manufacturer and the user have explicitly agreed to a different set of contractual terms.
Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), consolidated EN text (OJ L, 2024/2847, 20.11.2024; Official Journal of the EU). This page is AI-generated legal information, not legal advice. Verify against the Official Journal. Contact: yiango@proton.me