Ensure the product meets essential cybersecurity requirements (Annex I Part I)

Before you can sell your product in the EU, it must meet the security properties listed in Annex I Part I. These cover things like: no known exploitable vulnerabilities at launch, secure default configuration, protection of data, ability to receive updates, limited attack surface, and incident detection capabilities. Think of Annex I Part I as the technical pass/fail checklist your product must clear.

Legal text

Article 6(a) of Regulation (EU) 2024/2847 provides that products with digital elements shall be made available on the market only where:

they meet the essential cybersecurity requirements set out in Part I of Annex I, provided that they are properly installed, maintained, used for their intended purpose or under conditions which can reasonably be foreseen, and, where applicable, the necessary security updates have been installed.

Annex I Part I — Essential cybersecurity requirements for products

The product itself (not the manufacturer's processes) must satisfy all of the following, where applicable:

No known exploitable vulnerabilities — the product shall be placed on the market without any known exploitable vulnerabilities
Security by default — the product shall be placed on the market with a secure by default configuration, including the possibility to reset to original state
Protection of data — the product shall ensure protection of stored, transmitted or otherwise processed data against unauthorised access or disclosure
Data integrity — the product shall protect the integrity of stored, transmitted or otherwise processed data, commands, programs and configuration against manipulation or corruption by unauthorised parties
Data minimisation — the product shall process only data that are adequate, relevant and limited to what is necessary
Availability — the product shall protect the availability of essential functions and services, including resilience against and mitigation of denial-of- service attacks
Limited attack surface — the product shall minimise its own attack surface, including external interfaces
Reduced impact of incidents — the product shall be designed to minimise the impact of incidents using appropriate exploitation mitigation mechanisms and techniques
Security logging — the product shall provide security-related information by recording and/or monitoring relevant internal activity, including access to data
Update capability — the product shall ensure that vulnerabilities can be addressed through security updates, including, where applicable, through automatic updates and the notification of available updates to users

Applicability per product type

Not all Annex I Part I requirements apply to every product. The manufacturer's cybersecurity risk assessment (required under Art. 13(2)) determines which requirements are applicable. Where a requirement is not applicable, the manufacturer must include a clear justification in the technical documentation (Art. 13(4)).

Relationship to other obligations

This obligation sets the product-level standard; the corresponding process-level standard is in Art. 6(b) → OBL-ART6-02
Manufacturers demonstrate conformity via the conformity assessment procedures in Art. 32 → OBL-ART13-04
Technical documentation must record how each requirement is met → OBL-ART31-01

Evidence you may need

Cybersecurity risk assessment (Annex VII §3)
Test reports demonstrating compliance with each applicable Annex I Part I requirement
Justification for any Annex I Part I requirements deemed not applicable
Security update delivery mechanism documentation