in force 2024-05-20 INSERTED+1,695 −0§
Amended by Regulation (EU) 2024/1183 32024R1183
applies from: unknown (an inserted provision states its own application date only in prose)
A new Article 45a is added setting out cybersecurity precautionary measures for providers of web-browsers in relation to Article 45 obligations, including the circumstances under which such providers may take precautionary measures regarding a certificate, the notification duties owed to the Commission, the competent supervisory body, the certificate holder and the issuing qualified trust service provider, and the supervisory body's role in investigating and responding to such notifications.
Cited: Art. 45a, v2
text before / after
inserted text (02014R0910-20240520)
Article 45a Cybersecurity precautionary measures 1. Providers of web-browsers shall not take any measures contrary to their obligations set out in Article 45, in particular the requirements to recognise qualified certificates for website authentication and to display the identity data provided in a user-friendly manner. 2. By way of derogation from paragraph 1 and only in the event of substantiated concerns related to security breaches or the loss of integrity of an identified certificate or set of certificates, providers of web-browsers may take precautionary measures in relation to that certificate or set of certificates. 3. Where a provider of a web-browser takes precautionary measures pursuant to paragraph 2, the provider of the web-browser shall notify its concerns in writing, without undue delay, together with a description of the measures taken to mitigate those concerns, to the Commission, the competent supervisory body, the entity to whom the certificate was issued and to the qualified trust service provider that issued that certificate or set of certificates. Upon receipt of such a notification, the competent supervisory body shall issue an acknowledgement of receipt to the provider of the web-browser in question. 4. The competent supervisory body shall investigate the issues raised in the notification in accordance with Article 46b(4), point (k). Where the outcome of that investigation does not result in the withdrawal of the qualified status of the certificate, the supervisory body shall inform the provider of the web-browser accordingly and shall request that provider to put an end to the precautionary measures referred to in paragraph 2 of this Article.