Topic
Secure by design and default
The Part I properties, and the configuration duty behind the slogan.
The slogan has specific content. Products ship without known exploitable vulnerabilities and with a secure-by-default configuration F-040; consumer products install security updates automatically by default with a clear opt-out F-041; and the rest of the Part I properties — access control, data protection, minimisation, resilience — apply on the basis of the risk assessment F-017.
The honest reading of "where applicable"
The risk assessment indicates whether and how each item applies, and Article 13(4) asks for a clear justification in the technical documentation for any essential requirement treated as not applicable — a written reason, not vibes.
Verified facts this page relies on
- F-017 Annex I Part I — product properties (secure by design and default; see checklist items I.1–I.3m). Annex I Part I
- F-040 Products are made available without known exploitable vulnerabilities and with a secure-by-default configuration. Annex I Part I(2)(a)–(b)
- F-041 Security updates are installed automatically by default for consumer products, with a clear and easy-to-use opt-out mechanism. Annex I Part I(2)(c), Recital 56
Facts are maintained and human-verified in the CEMarque Facts Table (v2026.09.4, verified 2026-09-10).
Editorial review: Claude (AI reviewer, delegated by the editor), 2026-10-08. Methodology and correction process: how this site works.