ANNEX IISupplementary provisions
ANNEX II In Annex IV to Implementing Regulation (EU) 2024/482, Section IV.3, points 5 and 6 are replaced by the following: ‘5. Where the changes have been confirmed by the certification body to be minor, no new certificate shall be issued for the modified ICT product and a maintenance report to the initial certification report shall be established. The maintenance report shall be included as a subset of the impact analysis report, containing following sections: (a) introduction; (b) description of changes; (c) affected developer evidence. 6. The maintenance report referred to in point 5 shall be provided to ENISA for publication on its cybersecurity certification website.’.