UITP - UNIFE Joint Statement on the Cyber Resilience Act: Exemption needed for rail network extensions

Many cities in Europe strive to achieve more sustainable mobility and plan to create or extend metro, tram, or commuter train networks as these provide zero-emission transit options to millions of commuters every day. Local rail systems represent a very dynamic and fast-growing market in Europe and worldwide and they are the backbone of sustainable urban mobility in major cities. We are concerned that these projects may become impossible to implement once the Cyber Resilience Act applies to hard and software used for rail and urban rail systems, such as transmission systems for signalling, Communication-based train control (CBTC), or other sub-systems most of which incorporate products and software which fall within the scope of the current CRA proposal. It is important that the new components used in extensions are compatible with the existing legacy system to ensure the smooth operation of vehicles on these networks. The CRA regulation should not apply to specific products that are new but considered as an extension of legacy products, with the same characteristics, and that need to interact and be compatible with those legacy products.

The operational technology systems of urban or regional rail systems are long term investments and are maintained over decades. Extensions of those networks (e.g. a metro line extension) need to be functionally compatible with the legacy systems even if this means they may not comply with CRA requirements. Likewise, projects that were designed before the CRA takes effect, but the implementation of which only starts once the CRA must be applied, should not be required to be changed/retrofitted in mid-course.

If the European Parliament and the Council do not act – and the CRA applies to urban rail extensions – such projects cannot be implemented any more or would require an update of the entire legacy system, which would increase the investment costs (that are already high) to an extent the projects would no longer be economically viable. In consequence, the CRA would discourage the shift to zero-emission collective mobility for millions of citizens!

We count on the support of the EU institutions and urge you to amend the legal text, providing for an exemption of rail network extensions from the scope of the Cyber Resilience Act.

The signatories are ready to cooperate with the European Parliament and the Council to offer insights and perspectives on the matter, and remain available for further clarification and suggestions.

Read the pdf