Cyber Resilience Act Response Center Request a demoDemo

Guide Last updated 15 min read

The CRA in machinery and plant engineering: what manufacturers need to prepare for

A machine with a controller, operator panel, remote maintenance or an app is a product with digital elements. The obligations of the Cyber Resilience Act fall on the machine builder, not on the supplier of the controller. This page sets out the role, the Machinery Regulation, expected time of use, machines already in the field and the reporting obligation.

Under Article 3, point (1), of Regulation (EU) 2024/2847, a machine with a programmable logic controller, an operator panel, a remote maintenance interface or an app is a product with digital elements. The manufacturer within the meaning of the Regulation is the machine builder that places the machine on the market under its own name, not the supplier of the controller. The reporting obligation under Article 14 has applied since 11 September 2026 and also covers machines that have been running at customer sites for years. The remaining obligations apply from 11 December 2027 to every machine delivered from that date. Alongside this, the Machinery Regulation (EU) 2023/1230 applies from 20 January 2027, with its own cybersecurity requirements.

Key points

  • A machine with a controller, operator panel (HMI), remote maintenance or an app is a product with digital elements (Article 3, points (1) and (2)).
  • A bought-in controller does not in itself subject the machine to the stricter conformity assessment for important products (Article 7(1), second sentence). The due diligence obligation under Article 13(5) applies to the component.
  • The Machinery Regulation applies in parallel from 20 January 2027. Neither replaces the other; a single EU declaration of conformity is drawn up for both (Article 28(3)).
  • The support period is at least five years. Recital 60 names industrial control systems as a case for longer periods.
  • Machines already in the field remain outside the product requirements until they are substantially modified (Article 69(2)). The reporting obligation applies nonetheless (Article 69(3)).

Why is a machine a product with digital elements?

Article 3, point (1), defines the term broadly: a software or hardware product together with its remote data processing solutions. Under Article 2(1), it is enough that the intended purpose includes a direct or indirect data connection. A controller with Ethernet, a fieldbus, a service port, an operator panel or a radio module meets that test. Purely mechanical machines without software remain outside the scope.

Under Article 3, point (2), the product also includes remote data processing: software from the manufacturer that runs remotely and without which the product would lose a function. An app for remote monitoring with its own back end is therefore part of the product (recitals 11 and 12), a customer portal is not. The Regulation does not address remote maintenance as a case of its own, and neither does the Commission guidance. The guidance does, however, contain two comparable cases: a cloud service developed by the manufacturer that sends commands back to an industrial robot is remote data processing (section 8.3.4); a bought-in support service from a third-party provider is not, and is treated like a component (section 8.3.1). By the same criteria, remote maintenance software is part of the product if it comes from the manufacturer and an advertised function depends on it; a bought-in tool, by contrast, is a component. If no product function depends on a service access point, classification is a case-by-case question; its risk still belongs in the risk assessment (guidance, paragraphs 192 and 193). More in SaaS, cloud and remote data processing.

Who is the manufacturer: the machine builder or the controller supplier?

Both, each for its own product. The supplier is the manufacturer of the controller; under Article 3, point (13), the machine builder is the manufacturer of the machine, because it develops it or has it developed and markets it under its own name. A contract can settle who does the work, who supplies which documents and under whose name a product appears. But the manufacturer role follows from these facts, not from a label in the contract, and the responsibility cannot be handed over (Blue Guide 2022, section 3.1). The due diligence obligation under Article 13(5) applies to the controller, the operating system, the radio module and every library: components must not compromise the security of the product. A vulnerability discovered in the controller is reported by the machine builder to the supplier under Article 13(6) and handled in its own product.

Classification depends on the core functionality: under Article 7(1), second sentence, integrating an important product does not in itself subject the product into which it is integrated to the conformity assessment procedures for important products (Article 32(2) and (3)). A machine with an industrial PC and a real-time operating system is therefore a product in the default category, even though operating systems are listed in Annex III, class I; the machine builder assesses conformity itself (Article 32(1), point (a)). Anyone who places a third-party gateway on the market under their own name is treated as its manufacturer under Article 21. Details in Product classes and conformity assessment.

How does the CRA relate to the Machinery Regulation?

The Machinery Regulation (EU) 2023/1230 applies from 20 January 2027 (Article 54 as corrected, OJ L 169 of 4 July 2023). For the first time, its Annex III contains cybersecurity requirements: protection against corruption (section 1.1.9) and safety and reliability of control systems (section 1.2.1), which among other things must withstand reasonably foreseeable malicious attempts by third parties and keep a tracing log for the safety software (points (a) and (f)). The two apply side by side: the Machinery Regulation covers the safety of the machine, the CRA covers cybersecurity over the support period and the reporting obligation. Article 28(3) CRA provides for a single EU declaration of conformity for both. Harmonised standards for this are missing; since 20 January 2026, industry associations (including CECIMO) have been calling for these requirements to be postponed to 11 December 2027. Nothing has been decided, and no Commission proposal is known; the amendments to the Machinery Regulation so far, most recently Regulation (EU) 2026/1744 on AI systems, leave the cybersecurity requirements untouched (as of October 2026).

On top of this comes NIS2 for your own IT: from medium size upwards, machine building belongs to the manufacturing sector (Annex II NIS2), transposed in Germany since 6 December 2025. A machine builder with connected machines and at least 50 employees, or more than EUR 10 million in annual turnover and annual balance sheet total (section 28(2), point 3, of the German BSI Act, BSIG), can be subject to all three sets of obligations at once. The differences between the reporting obligations are set out in CRA and NIS2 compared.

How long do you have to provide security updates?

Longer than in other sectors. The support period under Article 13(8) reflects the time the product is expected to be in use and is at least five years. Recital 60 notes that industrial control systems are often used for significantly longer periods. A packaging machine runs for 15 to 20 years; five years would be open to challenge, ten years or more is realistic. The reasoning belongs in the technical documentation (Annex VII, point (4)) and must be consistent with the support periods of the components. Every security update remains available for at least ten years (Article 13(9)), and the end date is stated with month and year at the time of purchase (Article 13(19)). The Regulation does not expect automatic updates in industrial environments (recital 56), but secure distribution remains mandatory (Annex I, Part II, point (7)). Security updates are free of charge (point (8)); only for tailor-made products for business users can the contract provide otherwise (recital 64).

What applies to machines already in the field?

Article 69(2) applies to legacy products: machines placed on the market before 11 December 2027 are only subject to the requirements after a later substantial modification. What counts is the individual unit. Article 69(3) makes an exception for the reporting obligation: Article 14 applies to all products within scope, including machines from 2012.

A retrofit can be a substantial modification

Under Article 3, point (30), a substantial modification is a change after placing on the market that affects compliance with Annex I, Part I, or changes the intended purpose. According to recital 39, functionality updates that modify the functions, type or performance of the product are generally substantial; security updates and minor functional changes are not. The Commission guidance mentions new externally accessible interfaces (paragraphs 109 and 110) and a dashboard that initially only displays operating data and, after an update, can control the machines (Example 40): typical retrofit packages. If the later control function was already foreseen and secured in the risk assessment, there is no substantial modification (Example 43). If the machine builder substantially upgrades a machine in the field after 11 December 2027, the requirements apply, according to the guidance, to the modified part or, where cybersecurity is affected as a whole, to the entire product (paragraph 124). A third party that carries out the retrofit and makes the result available becomes a manufacturer itself under Article 22. The modified machine is then treated as newly placed on the market (paragraph 116). Vulnerability handling and the support period generally relate to the modified parts (paragraph 124); the period is only recalculated if the modification changes the expected time of use (paragraphs 133 to 135, Examples 55 and 56). If an operator converts a plant purely for its own use and does not make it available to anyone, there is no new placing on the market (paragraph 116; Commission services' FAQ, question 1.5).

  1. 11 September 2026Reporting obligation under Article 14 for all machines in the field, including legacy machines (Article 69(3), Article 71(2)).
  2. 20 January 2027Machinery Regulation with cybersecurity requirements in Annex III; no postponement decided.
  3. 11 December 2027The CRA applies in full to every machine delivered from that date, with fines under Article 64.

What the reporting obligation means for machine builders

Since 11 September 2026, Article 14(1) and (3) has required manufacturers to notify every actively exploited vulnerability and every severe incident via ENISA's single reporting platform, which in Germany means to CERT-Bund at the BSI. The stages: early warning within 24 hours of awareness, notification within 72 hours, and a final report 14 days after a corrective or mitigating measure is available for vulnerabilities (Article 14(2)), or one month after the 72-hour notification for incidents (paragraph 4). Operators must be informed under paragraph 8. Under Article 3, point (42), actively exploited means: reliable evidence that a malicious actor has exploited the vulnerability in a system without permission. A database entry for the built-in controller is not enough; an operator reporting strange logins on the operator panel, on the other hand, is a suspicious event that the Commission guidance says must be assessed immediately. The deadline runs from a reasonable degree of certainty that the vulnerability is being exploited in your own product (guidance, paragraph 213). The basics are in The reporting obligation explained.

The sector is poorly prepared for this. According to the study by VDMA and Fraunhofer AISEC of 1 April 2025, two thirds of machinery and plant manufacturers are directly affected by the CRA or NIS2; 30 per cent of small and medium-sized enterprises do not know whether they are affected. PwC's Product Security Survey 2026 of 11 September 2026 (100 German industrial companies, 65 per cent of them from machine building) found 3 per cent of companies fully compliant, 50 per cent that had not started implementation, 50 per cent without an external channel for vulnerability reports and 27 per cent without an internal process for product security incidents. The typical starting point: a service hotline for faults, but no mailbox for security reports, no security.txt, no rule on who assesses on a Saturday. A report from outside is logged as a fault. In Article 13(17) the Regulation requires a single point of contact that also receives vulnerability reports, and in Annex I, Part II, points (5) and (6), a coordinated vulnerability disclosure policy and a contact address. Formally, these requirements only apply from 11 December 2027; without them, however, the reporting obligation cannot be met even today. See the guide security.txt under RFC 9116 and BSI TR-03183-3.

Example: a manufacturer of packaging machines

A manufacturer of packaging machines with 120 employees builds machines with a bought-in controller, its own operator panel, a third-party remote maintenance module and its own app with a back end. Since 2016 it has delivered 400 machines to eight Member States.

  • Product and role. A product with digital elements, manufacturer under Article 3, point (13). The controller and the remote maintenance module are components subject to due diligence; the app with its back end is remote data processing.
  • Class. Default category, conformity assessment under its own responsibility; plus the Machinery Regulation and NIS2.
  • Machines in the field. The reporting obligation has applied to all 400 machines since 11 September 2026; for the early warning it needs a list of software versions per Member State.
  • Support period and retrofit. For machines from 11 December 2027 it sets ten years and derives this from the expected time of use. The retrofit package planned for 2028, which connects the 2016 machines to the back end, is likely to be a substantial modification.
  • Today. The only channel is the service hotline. First step: mailbox, security.txt, call chain, access to the ENISA platform.

For this step, CRA Response Center provides on-call readiness as a service: it monitors the security mailbox, recognises important reports at night too, alerts the people responsible and records awareness and deadlines in the history. Assessment and submission remain with the manufacturer.

Checklist for machine builders

  • Record the installed base. Machine types, software versions, Member States.
  • Clarify components. Bought in, own brand or developed in-house? Agree vulnerability information and support periods with suppliers (Article 13(5) and (6), Article 21).
  • Create a software bill of materials. SBOM for controller software, panel and back end (Annex I, Part II, point (1)).
  • Set up a reporting address. Mailbox, security.txt, coordinated vulnerability disclosure policy; train the hotline to forward security reports immediately.
  • Define the call chain. Who assesses at weekends too, who stands in, who decides; record the time of awareness.
  • Prepare for the ENISA platform. EU Login for two people, registration with Germany and CERT-Bund, standard text blocks in English.
  • Derive the support period. Expected time of use, component support, end date in the data sheet (Article 13(8) and (19)).
  • Review retrofit programmes. Assess every retrofit package for substantial modification before sale (Article 3, point (30)).
Free toolsecurity.txt generatorThe first item on the checklist in a few minutes: a security.txt file following BSI TR-03183-3 and a draft coordinated vulnerability disclosure policy.Create the file Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit

Frequently asked questions

Is a programmable logic controller an important product?

Not as such. Annex III lists operating systems, routers, switches and microcontrollers with security-related functionalities, but not machine controllers. A machine with a controller is usually a product in the default category.

Do machines from 2018 need CE marking under the CRA retrospectively?

No. Under Article 69(2), the requirements only apply to legacy products after a substantial modification. The reporting obligation has, however, applied to these machines since 11 September 2026 (Article 69(3)).

My controller supplier reports anyway. Do I have to report as well?

Yes, if the vulnerability is contained in your machine and is being actively exploited there. According to the Commission guidance, the obligation only falls away if the vulnerable code cannot be reached in your product or has not been exploited there (paragraph 218); reporting to the supplier under Article 13(6) still applies.

Is our service hotline enough as a reporting address?

As one of several channels, yes; on its own, no. Article 13(17) requires a single point of contact that also covers vulnerability reports. What matters is that a report immediately reaches someone who can assess it.

Do our machines have to install updates automatically?

No. Recital 56 does not expect automatic updates in industrial environments. Secure distribution (Annex I, Part II, point (7)) and keeping each update available for ten years (Article 13(9)) remain mandatory.

Further reading

Sources

The reporting obligation already applies. Who answers at night at your company?

CRA Response Center monitors your security mailbox, recognises important reports using AI hosted in Germany (your e-mails never go to OpenAI, Anthropic or Google) and alerts your people by SMS and e-mail. EUR 190 per month including VAT. Try it free for 30 days.

Try it free for 30 days