European Union: European Commission closes consultation on draft delegated act concerning exclusion of certain L-category vehicles from Cyber Resilience Act

On 2 June 2025, the European Commission closes the consultation period for the draft delegated act on the exclusion of certain L-category vehicles from the Cyber Resilience Act (CRA). The draft act excludes products with digital elements that are already subject to cybersecurity obligations under EU type-approval rules for L-category vehicles. This follows the extension of Regulation No. 155 to these vehicles, which will apply from 2027 for new types and 2029 for existing ones. The aim of the act is to prevent overlapping legal requirements while ensuring continued cybersecurity protection.