Member States should aim to address, to the extent possible, the challenges faced by vulnerability researchers, including their potential exposure to criminal liability, in accordance with national law. Given that natural and legal persons researching vulnerabilities could in some Member States be exposed to criminal and civil liability, Member States are encouraged to adopt guidelines as regards the non-prosecution of information security researchers and an exemption from civil liability for their activities.
Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), consolidated EN text (OJ L, 2024/2847, 20.11.2024; Official Journal of the EU). This page is AI-generated legal information, not legal advice. Verify against the Official Journal. Contact: yiango@proton.me