Regulation (EU) 2024/2847 · Chapter
Article 5 — Procurement or use of products with digital elements
Procurement or use: room for additional national requirements, and Annex I compliance as a procurement consideration.
LAW Official text — verbatim from the Official Journal snapshot; only the Official Journal is authentic.
1.1. This Regulation shall not prevent Member States from subjecting products with digital elements to additional cybersecurity requirements for the procurement or use of those products for specific purposes, including where those products are procured or used for national security or defence purposes, provided that such requirements are consistent with Member States’ obligations laid down in Union law and that they are necessary and proportionate for the achievement of those purposes.
2.2. Without prejudice to Directives 2014/24/EU and 2014/25/EU, where products with digital elements that fall within the scope of this Regulation are procured, Member States shall ensure that compliance with the essential cybersecurity requirements set out in Annex I to this Regulation, including the manufacturers’ ability to handle vulnerabilities effectively, are taken into consideration in the procurement process.
sha256:27b7c6c64c773001… · CELEX 32024R2847What this article does
Article 5 draws a boundary the scope discussion often misses: Member States may add cybersecurity requirements for the procurement or use of products for specific purposes, including national security or defence, provided those additions are consistent with Union law and necessary and proportionate; and when in-scope products are procured, Member States make sure that compliance with the Annex I essential requirements, including the manufacturer's ability to handle vulnerabilities, is taken into consideration.
The practical consequence
Selling into the EU is one compliance problem, governed here; selling to a particular government or regulated sector can stack additional procurement conditions on top, governed nationally. Vendors who conflate the two either over-comply everywhere or get surprised in tenders. The Regulation's baseline travels with every product made available in the course of a commercial activity F-007; additional procurement or use conditions come from the Member State that sets them.
Verified facts this page relies on
- F-007 The Regulation applies to products made available on the market in the course of a commercial activity; charging a price, charging for support, monetising via advertising or data, or otherwise intending to monetise are commercial activity. Art. 2(1), Art. 3(22), Recitals
Facts are maintained and human-verified in the CEMarque Facts Table (v2026.09.4, verified 2026-09-10).
Editorial review: Claude (AI reviewer, delegated by the editor), 2026-10-08. Methodology and correction process: how this site works.