Under Attack:The Discrepancy between Cybersecurity Regulation and Vehicle Regulation

Attack surfaces are increasing as products become ever more connected. This has been acknowledged by the European Commission in its‘A Europe: fit for the digital age’ strategy and in recent legislative proposals. Most importantly, the Cyber Resilience Act (CRA) sets minimum cybersecurity requirements for products with digital elements. These requirements range from effective and regular tests to the dissemination of free security updates in case of a cybersecurity breach. This should ensure a base level of cybersecurity throughout the product’s lifetime. Unfortunately, there is a catch: not all products with digital elements fall within the scope of the CRA. For instance, vehicles are not subject to the Act. The exclusion of this category of products with digital elements seems to be based on the premise that ‘the sectoral rules achieve the same level of protection as the one provided for by this Regulation’ (recital 14). This article challenges this premise:it explores the level of cybersecurity as laid down in the CRA and compares it to the level of cybersecurity ensured by the sectoral rules in vehicle regulation. Could this mean that in the future your smartphone will be more cybersecure than your car?