Delegated acts requiring mandatory European cybersecurity certification should determine the products with digital elements that have the core functionality of a category of critical products with digital elements set out in this Regulation that are to be subject to mandatory certification, as well as the required assurance level, which should be at least ‘substantial’. The required assurance level should be proportionate to the level of cybersecurity risk associated with the product with digital elements. For instance, where the product with digital elements has the core functionality of a category of critical products with digital elements set out in this Regulation and is intended for the use in a sensitive or critical environment, such as products intended for the use of essential entities as referred to in Article 3(1) of Directive (EU) 2022/2555, it may require the highest assurance level.
Recital 47 of 130
OFFICIAL TEXTRegulation (EU) 2024/2847·Official language version: English (EN)··Retrieved 2 November 2026·View on EUR-Lex
You are reading a consolidation made by regulation-cra.eu: the Official Journal text with its corrigenda and the amendments made by Regulation (EU) 2025/327 to Articles 13(4), 31(3) and 32(5a), which apply from 26 March 2027 (date to be verified). It is not an official consolidated version: only the texts published in the Official Journal are authentic. Versions and sources
OFFICIAL TEXTVerbatim, as published. Not rewritten.
(47)