+420 266 104 111 (8:00-16:30, Mo-Fr)
Order

Which legislation and standards apply to the industry?

18. 7. 2025

A variety of legislative frameworks and technical standards apply to both organizations and products:

Legislation:

  • NIS2 + new Cybersecurity Act – defines obligations for medium and large enterprises in key sectors (including manufacturing)

  • Cyber Resilience Act (CRA) – applies to all digital products placed on the EU market (including software, devices, and combined solutions)

  • RED Delegated Act – supplements the Radio Equipment Directive with cybersecurity requirements for wireless products (effective from August 1, 2025)

  • AI Act – upcoming EU regulation for AI systems, defining requirements based on risk levels (especially in areas like production control, quality, or predictive maintenance)

Standards:

  • ISO/IEC 27001 – Information Security Management System (for organizations)

  • IEC 62443 – Cybersecurity for industrial control systems and components (also applies to product development)

  • EN 18031 – Product vulnerability assessment and security testing (relevant for RED)

  • ETSI EN 303 645 – Baseline standard for consumer IoT cybersecurity

  • ISO/IEC 42001 – New international standard for AI system management, focused on transparency, risk management, and auditability

!!!Note: Management systems like ISO/IEC 27001 or the new Cybersecurity Act apply only to organizations—not products. Product and device security requires entirely different approaches, primarily based on IEC 62443.