Cyber Resilience Act (CRA)

(27) General Vehicle Safety Regulation (GVSR) of the European Parliament and of the Council establishes requirements for the type-approval of vehicles, and of their systems and components, introducing certain cybersecurity requirements, including on the operation of a certified cybersecurity management system, on software updates, covering organisations’ policies and processes for cybersecurity risks related to the entire lifecycle of vehicles, equipment and services in compliance with the applicable United Nations regulations on technical specifications and cybersecurity, in particular UN Regulation No 155 – Uniform provisions concerning the approval of vehicles with regards to cybersecurity and cybersecurity management system and providing for specific conformity assessment procedures. In the area of aviation, the principal objective of Civil Aviation Safety Regulation of the European Parliament and of the Council is to establish and maintain a high uniform level of civil aviation safety in the Union. It creates a framework for essential requirements for airworthiness for aeronautical products, parts and equipment, including software, that includes obligations to protect against information security threats. The certification process under Civil Aviation Safety Regulation ensures the level of assurance aimed for by this Regulation. Products with digital elements to which General Vehicle Safety Regulation (GVSR) applies and products certified in accordance with Civil Aviation Safety Regulation should not therefore be subject to the essential cybersecurity requirements and conformity assessment procedures set out in this Regulation.