INCEPTION IMPACT ASSESSMENT

Inception Impact Assessments aim to inform citizens and stakeholders about the Commission's plans in order to allow them to provide feedback on the intended initiative and to participate effectively in future consultation activities. Citizens and stakeholders are in particular invited to provide views on the Commission's understanding of the problem and possible solutions and to share any relevant information that they may have, including on possible impacts of the different options.

Title of the initiative

Commission delegated regulation on Reconfigurable Radio Systems

Lead DG – responsible unit

DG GROW, C3

Likely Type of initiative

Legislative (Delegated Regulation)

Indicative Planning

Q1 2020

Additional Information

-

The Inception Impact Assessment is provided for information purposes only. It does not prejudge the final decision of the Commission on whether this initiative will be pursued or on its final content. All elements of the initiative described by the Inception Impact Assessment, including its timing, are subject to change.

A. Context, problem definition and subsidiarity check

Context

Reconfigurable Radio Systems (RRS) exploit the capability of radio equipment to change its behaviour or be reprogrammed at the upload of new software. This is made possible by the software implementation of electronic components that were typically hardware (e.g. diodes, switches, mixers, filters, demodulators). Whilst initially conceived for military and defence applications, with the increased performance of the off-the-shelf electronics a variety of the equipment placed on the market can be reconfigured by means of software. Other than software defined radios, also more conventional radio equipment as mobile phones, routers, remote controllers, base stations, etc, can nowadays be reconfigured by software.

The progressive digitization of products and the inclusion of radio modules in goods that so far did not communicate or exchange data are boosting new technological developments, applications and services. In some cases, one of the basis for these developments is a flexible hardware that can assume different configurations according to the uploaded software (including firmware).

With the increasing number of radio equipment placed on the market and with the incoming advent of the Internet of Things, it is a priority to strengthen the legal certainty of the Digital Single and Internal Market, in line with the EU strategy on DSM and the recent adoption of the Communication on AI. In this framework it is important to reinforce the trust of consumers and service providers towards new technological developments 1 . 

This initiative should provide input to the Commission, collecting and analysing data in view of problems related to reconfigurable radio systems on the one hand and possible solutions and their consequences on the other hand, particularly regarding the potential use of Commission acts pursuant Articles 3(3)(i) 2 and 4 3 of the Radio Equipment Directive 2014/53/EU, hereinafter RED.

Problem the initiative aims to tackle

Software (e.g. firmware) can govern some aspects of the radio equipment or its components so to (i) enable/disable peripherals or components (e.g. fans), (ii) allow an increased power consumption or (iii) alter the transmitting power of radio equipment, having an impact on the electrical safety of the equipment. As chipsets and electronic boards can operate over several frequency bands, the upload of software into radio equipment can allow to operate it in frequencies that are not permitted by the national plans. In some cases, the severity of the problem can be magnified by the very large extent of frequency bands where the equipment can operate 4 . When radio equipment is intended for access to emergency services, the upload of new software may alter the tested protocols and have a major impact on the correct functionality of these devices. In the worst cases, new software can completely change the intended or reasonably foreseeable use of the equipment.

In some cases, the needed level of expertise to write software for reconfiguring radio equipment can be high. In other cases, however, software can be found online, possibly from third parties, and/or be uploaded without any insurance that the compliance of the equipment will be preserved.

As a consequence, this level of reconfigurability can have an impact on several aspects of radio equipment (e.g. radio spectrum access, interoperability, safety, disturbance or access to emergency services).

Basis for EU intervention (legal basis and subsidiarity check)

The Radio Equipment Directive 2014/53/EU (RED), which is based on Article 114 of the TFEU, establishes a regulatory framework for placing radio equipment on the market, ensuring a Single Market for radio equipment. The scope of the RED concerns devices that use the radio spectrum for communication and/or radio determination purposes. All internet connected wireless devices (e.g. comprising the IoT), for example, fall under this Directive.

Articles 3(1) and (2) of the RED sets out the essential requirements that radio equipment shall respect, which relate with health and safety, electromagnetic compatibility and radio spectrum. For specific classes, the requirements of Article 3(3)(g)  5 already apply for access to emergency services.

The RED ensures that radio equipment, at the moment of its placing on the market, is demonstrated to respect the essential requirements of the Directive. This is also clarified in the RED Guide 6 . However, new software may alter the demonstrated safety or behaviour of the equipment. This problem was highlighted since at the TCAM WG, where in February 2016 an ad-hoc subgroup was created, with the production of a related report in June 2017.

Article 3(3) provides the basis for further delegated regulation governing additional aspects, empowering the Commission to adopt delegated acts in order to specify which categories or classes of radio equipment are concerned by each of the requirements set out in its points (a) to (i). These requirements relate with interoperability, emergency services, software, fraud, accessibility, privacy, personal data and misuse. Namely, Article 3(3)(i) refers to software.

Moreover under Article 4 of the RED, manufacturers of radio equipment and of software allowing radio equipment to be used as intended shall provide the Member States and the Commission with information on the compliance of intended combinations of radio equipment and software with the essential requirements set out in Article 3 of the RED.

Article 4(2) of the RED empowers the Commission to adopt delegated acts specifying which categories or classes of radio equipment are concerned by the requirement set out in paragraph 1 of Article 4. Article 4(3) of the RED empowers the Commission to adopt implementing acts laying down the operational rules. Article 4 thus is applicable if the Commission adopts related delegated and implementing acts.

In recital (19) of the same Directive, the co-legislators also stressed that Verification by radio equipment of the compliance of its combination with software should not be abused in order to prevent its use with software provided by independent parties. The availability to public authorities, manufacturers and users of information on the compliance of intended combinations of radio equipment and software should contribute to facilitate competition.

For any aspects covered by the RED, Member States cannot impede radio equipment to be made available on the market in their territory, when it complies with the Directive (Article 9(1)).

It is also finally noted that Internet-connected radio equipment and wearable radio equipment in the scope of this initiative may fall in the scope of a parallel initiative 7 aiming to strengthen their privacy and the anti-fraud features, according to Articles 3(3)(e) and (f) of the RED 8 . When/if both initiatives would be completed, the goal would be that the level of protection of privacy and against fraud at the moment of placing Internet-connected radio equipment and wearable radio equipment on the market would be maintained at the upload of new software also after the initial placing on the market, i.e. throughout its lifecycle. The certainty of the preservation of the compliance of this category of radio equipment, which may be particularly exposed to privacy threats and frauds, throughout its life-cycle is a key feature to ensure that new technologies can be used by consumers with trust.

B. Objectives and policy options

Through this initiative, it is aimed to to avoid that radio equipment can be altered by way of software in a way that renders it non-compliant/unsafe 9 .

The following regulatory options will be considered:

·Option 0, baseline scenario: a situation in which manufacturers are not obliged to implement any specific measures as it is currently the case.

·Option 1, a situation whereby the industry self-regulates to ensure that software uploaded into radio equipment does not compromise the initial compliance.

·Option 2, adoption of a delegated act pursuant Article 4. This will require that manufacturers of radio equipment and of software allowing radio equipment to be used as intended shall provide the Member States and the Commission with information on the compliance of intended combinations of radio equipment and software, before the software can be uploaded into radio equipment.

·Option 3, adoption of a delegated act pursuant Article 3(3)(i).This will require that radio equipment supports certain features in order to ensure that software can only be loaded into the radio equipment where the compliance of the combination of the radio equipment and software has been demonstrated, and this requirement will have to be demonstrated for the purposes of market access.

·Option 4, adoption of a delegated act pursuant both Articles 3(3)(i) and 4. In this case, both requirements in Options 2 and 3 will have to be demonstrated for the purposes of market access.

The main objectives intended to be achieved are:

·Stimulating the development of the Digital Single Market and improving the functioning of the internal market in the field of new technological developments.

·Creating consumer trust in radio equipment and new technological developments, ensuring compliance of the equipment also at the upload of new software.

·Ensuring that Innovation and research does not compromise the demonstrated level of safety at the moment of placing on the market.

·Harmonising the conditions for market access, also aiming to prevent National Regulations to be put in place.

C. Preliminary assessment of expected impacts

Likely economic impacts

The following impacts will be taken into account:

I.Operating costs of and administrative burden on manufacturers of radio equipment and related software;

II.Innovation and competitiveness as also related to SMEs;

III.Functioning of the Internal Market, also in terms of fair competition;

IV.Risks of lockdown of radio equipment and applicability of open source software and open source hardware;

V.Effects on Public resources (e.g. radio spectrum, efficiency of access to emergency services, electromagnetic disturbance);

VI.Consumers (e.g. impact on the retail price);

The main stakeholders affected by this initiative will be some manufacturers of radio equipment. Since some companies are SMEs, the initiative will include SME test analysis, proportionate to the expected impact.

Manufacturers respecting the highest standards of compliance are predicted not to be affected by this initiative, which will mostly impact those manufacturers with a reduced attention to the compliance of their products. Some non-EU countries have already imposed that manufacturers must take steps to ensure that only software that has been approved with a software defined radio can be loaded into the radio and that any radio in which the software is designed or expected to be modified by a party other than the manufacturer […] must be certified as a software defined radio. These requirements are applied in markets where the allowed conformity assessment procedures foresee type approval, yet neither market access of this kind of radio equipment, nor prices, appear to be affected.

Likely social impacts

·Increased security and safety for EU citizens in the digital society and economy.

·Increased protection of personal data and against frauds (if and when delegated acts pursuant Articles 3(3)(e) and/or (f) of the RED are applied in parallel).

·Increased capacity of producers in the European Union to make their products secure.

·Increased consumer trust in the Digital Single Market and the digitization of traditional goods.

Likely environmental impacts

No specific or major impact on the environment is expected at this stage of the analysis.

Likely impacts on fundamental rights

Increased capacity of the European Union to autonomously secure its products and services is also likely to help the citizens to better protect their information-related rights.

Preservation of the compliance of the combination of radio equipment and software in terms of privacy and prevention from frauds when/if potential essential requirements pursuant Articles 3(3)(e) and/or (f) are made applicable.

Likely impacts on simplification and/or administrative burden

The RED is a new approach legislation, where only essential requirements are defined. Manufacturers are requested to demonstrate how the technical solutions in their products comply with the law.

On the one hand, one or more delegated acts pursuant this initiative would create some additional burden for the manufacturers, who would have to demonstrate compliance with the new essential requirements.

On the other hand, however, the European Standard Organizations (ESOs) would be asked to prepare harmonised standards in support of the legislation. This would allow manufacturers using the technical specifications contained therein to presume conformity of their products with the law. It is relevant that the European Standardization Organizations have started the production of reports and specifications for complex systems 10 . As some of them relate to the IoT, of which internet-connected and wearable radio equipment can be part, these products can already benefit from the flourishing production of standards and technical specifications in this field. The more available technical solutions, the easier the production of harmonised standards. As a consequence, it is expected that this industry-driven process would reduce the burden on manufacturers and ease the fulfilment of the conformity assessment procedures.

In any case the impact on simplification can be high, compared to the scenario of MS adopting provisions at a National level.

D. Evidence base, data collection and better regulation instruments

Impact assessment

An impact assessment is being prepared to support the preparation of this initiative and to inform the Commission's decision. The Impact Assessment is likely to be finalized in the 4th quarter of 2019.

Evidence base and data collection

The Commission has already established an Expert Group (E03413) on Reconfigurable Radio Systems (EG RRS) in order to provide expertise with respect to any possible initiative pursuant Articles 3(3)(i) and 4 of the RED. The Group gathered 6 times so far and the progress of the discussions can be found in the EG RRS repository in CIRCABC.

The Impact Assessment will be based on in-house data of the Commission 11 and other relevant data such as compliance costs or market information. Further evidence will be gathered by a service contract to support the impact assessment.

Consultation of citizens and stakeholders

In line with the Better Regulation Guidelines, the Commission will consult stakeholders as widely as possible. The aim of this consultation is to gather external information on the possible gaps in the legislative framework and investigate which policy options would allow to increase legal certainty, facilitate the implementation of the Internal and Digital Single Markets and reinforce the consumers’ trust in new technological developments. A broad set of stakeholders will be consulted including national authorities, competence centres and research community across the EU, industry, EU institutions and bodies, consumers and consumer organisation and others. Depending on the stakeholder group identified, different tools and methods will be used to conduct the consultation.

During a 4-week period, all interested stakeholders will be able to provide feedback on this Inception Impact Assessment.

The Expert Group on Reconfigurable Radio Systems E03413 has been providing support to the Commission for the last year. The documents are publicly available in CIRCABC.

The impact assessment process will include both an open public and targeted consultations. The more specific, targeted consultations will take place by means of interviews and surveys with:

·Representatives of competent authorities in Member States responsible for the implementation of the RED (Directive 2014/53/EU);

·Representatives of stakeholder's associations (Industry and SMEs, consumers, European Standardization Organisations, etc.);

·Representatives from NGOs representing civil society, in particular those involved in the open source software and hardware development and circulation.

The different tools that will be used to reach stakeholders are:

·12-week internet based open public consultation, in 6 languages, to be carried out through on-line consultation tools in order to ensure transparency and accountability and to give any interested party the possibility to contribute).

·Targeted consultations and interviews with the representatives of the stakeholders mentioned above (3 languages).

·Targeted consultation of EU SME umbrella organisations and contact points in Enterprise Europe Network (EEN)

The public and targeted consultations and the interviews are expected to take place in Q2 2019.

The results of the consultations will be made available by means of a synopsis report.

Will an implementation plan be established?

An implementation plan will not be established, as this initiative does not require adoption by the Member States of new transposition/implementation measures.