Cybersecurity Act 2 and mobility: ensuring proportionate and workable ICT supply-chain rules for connected vehicles

Executive summary

The proposed Cybersecurity Act 2 would establish a binding EU framework for addressing non-technical risks in critical ICT supply chains. DIGITALEUROPE supports the objective of a harmonised, evidence-based approach. Its application to mobility must, however, account for the sector’s existing mandatory cybersecurity framework, integrated vehicle architectures, long development and service lifecycles, and global manufacturing networks. The relevance and proportionality of any future measure should depend on the presence and criticality of the ICT functions concerned. Vehicles and manufacturers differ in their levels of connectivity, remote-access capabilities and exposure to ICT supply-chain risks; measures should be targeted accordingly.