The Cyber Resilience Act's Latent Log-Integrity Obligation: Why Europe's Action-Logging Duty Cannot Discharge Its Own Demonstration Architecture
Year: 2026
Type: preprint
Abstract: European Union product-cybersecurity law harbours a latent, unfulfilled log-integrity obligation. The Cyber Resilience Act (Regulation (EU) 2024/2847) imposes, in Annex I Part I, both an integrity duty over data, commands, programs, configuration (point (2)(f)) and a separate duty to record relevant internal activity in a security log (point (2)(l)). On its text, the integrity duty does not reach the security log generated under (2)(l): the objects of (2)(f) are a closed enumeration into which a self-produced audit log does not naturally fall. Yet the Act own demonstration-and-retention architecture -- Article 13(7)/13(13), Article 31 with Annex VII, and a disposal horizon of ten years or more -- cannot achieve its purpose unless that log is tamper-evident and independently verifiable. A record the custodian can silently rewrite cannot discharge a decade-long duty to demonstrate. The (2)(f)/(2)(l) coverage gap is therefore not a neutral legislative silence but an effet-utile defect: on a purposive reading the Act already implies a latent integrity obligation over the action log. The contribution is a defended doctrinal holding, an effet-utile argument, a standardisation-design analysis at the delegation seam, and a falsifiable record-custodian-as-adversary threat model.
Author: Sokolov, Anton
Language: English
Subfield: Law
Field: Social Sciences
Domain: Social Sciences
Open Access status: green
OpenAlex ID: W7166460153
Cites:
Cited by:
Related to: