The UK government has issued an Explanatory Memorandum (EM) detailing Council Decision 2025/799, which concerns the integration of the European Union's Cyber Resilience Act (CRA) into the Windsor Framework. This decision specifically involves adding Council Decision 2020/135 to Annex 2 of the framework, clarifying the regulatory pathway for cybersecurity standards concerning products placed on the market in Northern Ireland.
The EU Cyber Resilience Act, adopted by the European Council, is a significant piece of legislation designed to bolster the cybersecurity of hardware and software products throughout their lifecycle. It establishes common security standards for digital products, aiming to reduce vulnerabilities and ensure that manufacturers take responsibility for the security of their offerings from the design phase onwards. This includes obligations for vulnerability handling and incident reporting.
The Explanatory Memorandum, a summary prepared by the government, outlines the implications of Council Decision 2025/799. By adding Council Decision 2020/135 to Annex 2 of the Windsor Framework, the UK government is formalising how certain EU legislation, in this case related to digital product security, will apply in Northern Ireland. The Windsor Framework, agreed upon in February 2023, sought to address trade and customs issues arising from the Northern Ireland Protocol, aiming to safeguard Northern Ireland’s place in the UK’s internal market while respecting its unique access to the EU’s single market for goods.
The inclusion of the Cyber Resilience Act through this mechanism underscores the ongoing regulatory alignment between Northern Ireland and the EU in specific sectors, particularly those related to the digital single market. Businesses operating in Northern Ireland, especially those involved in manufacturing or distributing digital products, will need to be aware of these evolving cybersecurity requirements. This ensures that products available in Northern Ireland meet the same robust security standards as those in the rest of the EU.
The broader context of this decision lies in the continuous effort to manage the complexities of post-Brexit arrangements for Northern Ireland. The Windsor Framework provides a legal and practical basis for the application of certain EU laws in Northern Ireland to avoid a hard border on the island of Ireland. The EM serves to inform the UK Parliament about the nature and implications of such EU decisions and their domestic application.