Cyber Resilience Act for Machinery & Industrial Automation

The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, introduces horizontal cybersecurity requirements for “products with digital elements” for the first time. For machinery and industrial automation this is more than a legal question: controllers, network components, embedded firmware and connected components are within scope once they have a direct or indirect logical or physical data connection to a device or network (Art. 2(1)). This page offers technical and organisational orientation - not legal advice; how your specific products are classified always depends on the individual case.

Timeline: the deadlines that matter for machine builders

The CRA does not apply “from entry into force”. Its obligations phase in (Art. 71(2)). For machinery product planning, two dates matter most, and the sequence relative to the Machinery Regulation deserves attention.

Note: the Art. 14 reporting duties have already applied since 11 September 2026, and they cover products already on the market. For machines in the field this means you must already be able to detect, assess and report actively exploited vulnerabilities and severe incidents on time.

Product classification: where do automation components land, schematically?

The CRA has four tiers (Art. 32, Annex VIII): the default case (self-assessment), important products Class I (Annex III-I), important products Class II (Annex III-II), and critical products (Annex IV). The following classification is deliberately hedged; what counts is the individual case, together with the category descriptions in Implementing Regulation (EU) 2025/2392.

• Industrial components - such as microcontrollers with security functions, network management, routers/modems/switches or operating systems - can be classified as an important product of Class I.
• Certain security components - firewalls, IDS/IPS and tamper-resistant micro-processors/-controllers - fall into Class II.
• Default-category products may self-assess (Module A). Class I may self-assess where harmonised standards, common specifications or a European cybersecurity certification scheme (assurance level at least “substantial”) are applied in full; otherwise a third party must be involved (Module B+C or H). Third-party assessment is required in every case for Class II and critical products, and for Class I whenever standards, common specifications or a scheme are not applied in full.

This overview does not replace a case-by-case classification. Details and examples are in our article on the CRA product classes.

What the CRA substantively requires (Annex I)

Regardless of class, all products in scope must meet the essential requirements of Annex I. Part I concerns product properties: an appropriate level of cybersecurity based on a risk assessment, delivery without known exploitable vulnerabilities, a secure default configuration, protection of confidentiality and integrity, and minimisation of the attack surface. Part II concerns vulnerability handling across the entire support period - including an SBOM, a mandatory coordinated vulnerability disclosure (CVD) policy, and secure update distribution.

For connected machinery it is especially relevant that these requirements do not end at shipping. The Annex I risk assessment must be documented and mapped to concrete measures in the technical documentation (Annex VII) - a continuous line of evidence “from design to the field”.

Interplay with the Machinery Regulation (EU) 2023/1230

Machinery manufacturers with connected products must meet both frameworks: the Machinery Regulation (EU) 2023/1230, which applies from 20 January 2027, and the CRA from 11 December 2027. Both address overlapping cybersecurity risks; the CRA explicitly acknowledges this interplay (recital 53).

Because the Machinery Regulation becomes applicable before the CRA, it is advisable to design cybersecurity measures from the outset so that they meet both frameworks. This avoids retrofitting twice.

Specific challenges for machines in the field

Machinery brings conditions that need particular attention during implementation:

• Long product lifetimes and the support period: the manufacturer sets the support period so that it reflects the expected time of use, and at least 5 years (shorter only where the expected use is shorter). For machines that stay in service for a long time, take this into account early in architecture, component selection and the update path.
• SBOM for embedded firmware: Annex I Part II requires a software bill of materials (SBOM) in a commonly used, machine-readable format, at least for top-level dependencies. The more supplier components an embedded system contains, the more this becomes a data-management task. The Regulation does not mandate a specific format.
• Secure updates in the field: security updates must be disseminated without delay and free of charge, unless otherwise agreed with the business user for a tailor-made product, and distributed securely; security updates should be separated from feature updates where technically feasible. Machines without permanent connectivity need a defined, documented update path for this.
• Technical documentation (Annex VII): product description, architecture, SBOM, CVD policy, risk assessment against Annex I, support-period information. Retain for at least 10 years or for the duration of the support period, whichever is longer.

Action areas and a realistic roadmap

1. Immediately: complete exposure and classification analysis, introduce a vulnerability-handling and reporting process (Art. 14 has applied since 11 Sep 2026).
2. Now to 2027: build the SBOM, secure updates, technical documentation and Annex I risk assessment; design cybersecurity in line with the Machinery Regulation (from 20 Jan 2027).
3. Before 11 Dec 2027: carry out the conformity assessment, draw up the EU declaration of conformity, prepare CE marking. Plan early for a notified body for Class II, critical products and Class I without fully applied harmonised standards, common specifications or a European scheme.

For infringements of Annex I and of Articles 13 and 14, Article 64(2) provides for fines of up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher. Member States lay down the detailed rules on penalties.