Navigation on this site is not optimized for your browser

Please use a recent version of Google Chrome, Mozilla Firefox, Safari or Microsoft Edge to get the most out of the experience.

Find a modern browser
Hero picture
EU Position

UITP - UNIFE Joint Statement on the Cyber Resilience Act: Exemption needed for rail network extensions

  • Europe
  • Cyber Security
  • EU Position Papers
  • European legislation

Rail network extensions ought to be excluded from the Cyber Resilience Act

Many cities in Europe strive to achieve more sustainable mobility and plan to create or extend metro, tram, or commuter train networks as these provide zero-emission transit options to millions of commuters every day. Local rail systems represent a very dynamic and fast-growing market in Europe and worldwide and they are the backbone of sustainable urban mobility in major cities. We are concerned that these projects may become impossible to implement once the Cyber Resilience Act applies to hard and software used for rail and urban rail systems, such as transmission systems for signalling, Communication-based train control (CBTC), or other sub-systems most of which incorporate products and software which fall within the scope of the current CRA proposal. It is important that the new components used in extensions are compatible with the existing legacy system to ensure the smooth operation of vehicles on these networks. The CRA regulation should not apply to specific products that are new but considered as an extension of legacy products, with the same characteristics, and that need to interact and be compatible with those legacy products.

The operational technology systems of urban or regional rail systems are long term investments and are maintained over decades. Extensions of those networks (e.g. a metro line extension) need to be functionally compatible with the legacy systems even if this means they may not comply with CRA requirements. Likewise, projects that were designed before the CRA takes effect, but the implementation of which only starts once the CRA must be applied, should not be required to be changed/retrofitted in mid-course.

If the European Parliament and the Council do not act – and the CRA applies to urban rail extensions – such projects cannot be implemented any more or would require an update of the entire legacy system, which would increase the investment costs (that are already high) to an extent the projects would no longer be economically viable. In consequence, the CRA would discourage the shift to zero-emission collective mobility for millions of citizens!

We count on the support of the EU institutions and urge you to amend the legal text, providing for an exemption of rail network extensions from the scope of the Cyber Resilience Act.

The signatories are ready to cooperate with the European Parliament and the Council to offer insights and perspectives on the matter, and remain available for further clarification and suggestions.


  • UITP

    Annika DEGEN

    Deputy Director - Senior Policy Expert Digitalisation - Seconded by VDV
    [email protected]
This website uses cookies

This website uses third-party website tracking technologies to give you the best experience, help us understand and continually improve how the site works, and to display advertisements according to users' interests. You consent to the use of our cookies by continuing to browse this website.

Cookies page
Show Details
Name Description
Core and Analytic Core cookies are essential for the website to function by allowing you to browse the website and use some of its features. Analytic cookies help us analyse how the site is used and allow us to perfect and improve your user experience. These cookies do not collect information that identifies you and are enabled by default.
Name Description
Functional These cookies allow a website to remember the user’s site preferences and choices they make on the site including username, region, and language. The data collected by these cookies are only used in connection with this website and cannot be used to track your browsing on other websites.
Name Description
Advertising These cookies track the surfing behavior of a user to a website and personalise your experience by showing you advertisements, offers, etc. tailored to your interests and preferences.