Question 1

Is a vehicle system under type approval an important product under the Cyber Resilience Act, and what does it still have to do?

Accepted Answer

No. Regulation (EU) 2019/2144 applies where the system is fitted under the vehicle's type approval (Art. 2(2)(c)); an aftermarket unit is read by its function, so this is a question. The Cyber Resilience Act's classes do not apply; the UK PSTI rules and California's law are read by where it is sold.

Question 2

What does a vehicle system under type approval sold to UK consumers or in California have to show?

Accepted Answer

Under the UK PSTI rules: no universal default password, a published point of contact for security issues, a published defined support period, and a statement of compliance with the product. Under California Civil Code 1798.91.04: a reasonable security feature, and for authentication outside a local area network a password unique to each device or one the user sets before first access.

Vehicle system under type approval

A line that places here

Other functions in out of scope (article 2)