Hero picture
EU Position
publication

UITP - UNIFE Joint Statement on the Cyber Resilience Act: Exemption needed for rail network extensions

  • Europe
  • Cyber Security
  • EU Position Papers
  • European legislation

Rail network extensions ought to be excluded from the Cyber Resilience Act

Many cities in Europe strive to achieve more sustainable mobility and plan to create or extend metro, tram, or commuter train networks as these provide zero-emission transit options to millions of commuters every day. Local rail systems represent a very dynamic and fast-growing market in Europe and worldwide and they are the backbone of sustainable urban mobility in major cities. We are concerned that these projects may become impossible to implement once the Cyber Resilience Act applies to hard and software used for rail and urban rail systems, such as transmission systems for signalling, Communication-based train control (CBTC), or other sub-systems most of which incorporate products and software which fall within the scope of the current CRA proposal. It is important that the new components used in extensions are compatible with the existing legacy system to ensure the smooth operation of vehicles on these networks. The CRA regulation should not apply to specific products that are new but considered as an extension of legacy products, with the same characteristics, and that need to interact and be compatible with those legacy products.

The operational technology systems of urban or regional rail systems are long term investments and are maintained over decades. Extensions of those networks (e.g. a metro line extension) need to be functionally compatible with the legacy systems even if this means they may not comply with CRA requirements. Likewise, projects that were designed before the CRA takes effect, but the implementation of which only starts once the CRA must be applied, should not be required to be changed/retrofitted in mid-course.

If the European Parliament and the Council do not act – and the CRA applies to urban rail extensions – such projects cannot be implemented any more or would require an update of the entire legacy system, which would increase the investment costs (that are already high) to an extent the projects would no longer be economically viable. In consequence, the CRA would discourage the shift to zero-emission collective mobility for millions of citizens!

We count on the support of the EU institutions and urge you to amend the legal text, providing for an exemption of rail network extensions from the scope of the Cyber Resilience Act.

The signatories are ready to cooperate with the European Parliament and the Council to offer insights and perspectives on the matter, and remain available for further clarification and suggestions.

Contact

  • UITP

    Annika DEGEN

    Deputy Director - Senior Policy Expert Digitalisation - Seconded by VDV
    [email protected]
This website uses cookies

This website uses third-party website tracking technologies to give you the best experience, help us understand and continually improve how the site works, and to display advertisements according to users' interests. You consent to the use of our cookies by continuing to browse this website.

Cookies page
  • Essentials Essentials

    Those cookies are essentials to the functioning of the site and cannot be disabled in our systems. They are generally set as a response to actions you take that constitute a request for services, such as setting your privacy preferences, logging in, or filling out forms. You can set your browser to block or be notified of these cookies, but some parts of the website may be affected. These cookies do not store any personally identifying information.

    cloudflare

    Cloudflare uses various cookies to maximize network resources, manage traffic, and protect our customers’ sites from malicious traffic.

    epic-cookie-prefs

    Cookie that remembers the user’s cookie settings preferences. It allows to avoid asking the user about their preferences each time they visit the website.

  • Performance

    This Google Analytics cookie is used to persist session state. Google Analytics is a web analytics service offered by Google that tracks and reports website traffic anonymously.

    _ga

    This Google Analytics cookie is created when you first visit our site. It contains the version of Google Analytics, a randomly generated ID and a datetime group of your first visit. Google Analytics is a web analytics service offered by Google that tracks and reports website traffic anonymously.

    _ga_(STREAM ID)

    This Google Analytics cookie is used to persist session state. Google Analytics is a web analytics service offered by Google that tracks and reports website traffic anonymously.

This website uses cookies

We use cookies and similar techonologies to adjust your preferences, analyze traffic and measure the effectiveness of campaigns. You consent to the use of our cookies by continuing to browse this website.