Conduct a cybersecurity risk assessment before placing on the market
- Gilt für
- Manufacturer
- Quellenangaben
- Art. 13(2)Annex I Part I §1
- Produktklassen
- default, important-class-i, important-class-ii, critical
Einfache Sprache
Before you sell your product, you must assess its security risks in writing. This is not a checkbox exercise — the findings must change how you design and build the product. Document what threats you considered, what risks you found, and what you did to address them.
Legal text
Article 13(2) of Regulation (EU) 2024/2847 requires that manufacturers of products with digital elements shall, taking into account the essential cybersecurity requirements set out in Annex I Part I, carry out an assessment of the cybersecurity risks associated with a product with digital elements.
That assessment shall be taken into account during the planning, design, development, production, delivery, and maintenance phases of the product with a view to minimising cybersecurity risks, preventing security incidents, and minimising the impact of such incidents.
Key requirements
- Pre-market risk assessment — completed before placing the product on the market
- Risk-informed design — findings must feed into product design decisions
- Full lifecycle scope — covers planning, design, development, production, delivery, and maintenance
- Documentation — the risk assessment forms part of the technical documentation required by Annex VII
- Proportionality — depth of assessment must be proportionate to the risks
Relationship to other obligations
This obligation underpins most other Art. 13 duties. The risk assessment drives:
- Which Annex I Part I requirements apply and how
- The appropriate conformity assessment route (Module A, B+C, or H)
- The declared support period (OBL-ART13-08)
- What vulnerabilities to address before distribution (OBL-ART13-05)
Evidence you may need
- Cybersecurity risk assessment document (STRIDE, TARA, or equivalent methodology)
- Threat model with attack surface analysis
- Risk treatment decisions linked to design choices
- Records showing the assessment was updated when the product changed