ANATEL Act No. 2436 sets out the cybersecurity requirements for assessing the compliance of CPE (customer premises equipment) devices and entered into force on 10 March 2024.

The Act establishes a set of mandatory cybersecurity requirements for CPE devices used to connect to internet service provider networks, such as:

1. Cable modems

2. xDSL modems

3. ONUs and ONTs

4. Routers or modems for fixed wireless access (FWA)

5. Routers or modems for fixed broadband access via satellite

6. Wireless routers or access points

On 9 March, ANATEL issued Official Letter No. 83, with the following content:

Provided that the applicant has formally approved the project with the OCD (formally accepted by the OCD) before 9 March, ANATEL will accept the approval of new equipment and the update of certificates without cybersecurity testing. In these cases, the applicant must submit the cybersecurity test report by 6 July 2024. If the applicant fails to submit the report by this date, ANATEL will suspend the issuance of the certificate.

This exception is an option for applicants. If the option is taken, the applicant will need to sign a declaration undertaking to submit the cybersecurity report by the deadline set by ANATEL and, in the event of test failure, to remove all units sold on the Brazilian market or arrange their recall under the conditions described in the Brazilian Consumer Code.

Note: new approvals or renewals from 10 March onwards require the submission of a cybersecurity test report.