About the Opinion 23/2022 of The European Data Protection Supervisor

First things first, it should be noted that the wide scope of the Proposal covers all products with digital elements, and specifically means any software or hardware product and its remote data processing solutions, including software or hardware components to be placed on the market separately, whose intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. This includes both products that can be connected physically via hardware interfaces and products that are connected logically, such as via network sockets, pipes, files, application programming interfaces and any other type of software interface. 

At the same time certain digital products and services subject to sectoral legislation fall outside of the Proposal’s scope. These include software-as-a-service, medical devices, in vitro diagnostic medical devices, motor vehicles, products used exclusively for national security or military purposes or designed specifically to process classified information.

Therefore, in line with the Proposal, the Opinion 23/2022 of the EDPS can be summarized as follows:

It follows that a new EU Regulation, which will impose a European cybersecurity certification scheme for products with digital elements, could be adapted in the near future. 

Therefore, all the businesses developing or using products with digital elements shall keep in mind that the existence of a certificate should be ascertained (yet still being more of a recommendation), which would then indicate overall compliance of the digital products with the regulation, including the privacy requirements set by the GDPR.