What is the Cyber Resilience Act?
The Cyber Resilience Act (CRA) – Regulation (EU) 2024/2847 – sets EU-wide mandatory cybersecurity requirements for products with digital elements for the first time. This covers hardware and software that can be connected, directly or indirectly, to a device or network. Like the Machinery Regulation, the CRA is a regulation: it applies directly in all member states.
The aim: products should be developed securely from the start (“security by design”), shipped with secure default settings and receive security updates throughout their support period.
Is my machine in scope?
Very likely, as soon as it contains digital elements with a connection option. Typical examples in machine building:
- controllers and HMIs with Ethernet, fieldbus or wireless interfaces,
- remote maintenance and remote service access,
- machines with cloud connectivity, data acquisition or app control,
- software supplied with the machine – such as configuration, visualisation or diagnostic tools.
Not covered are, among others, pure SaaS offerings unrelated to a product and areas with their own special rules (e.g. medical devices, motor vehicles). Whether and in which class your product falls – default, “important” or “critical” product – determines the conformity assessment procedure.
Deadlines at a glance
| Date | What applies |
|---|---|
| 10 Dec 2024 | CRA enters into force |
| 11 Jun 2026 | Provisions on conformity assessment bodies |
| 11 Sep 2026 | Reporting obligations for actively exploited vulnerabilities and severe security incidents – also for products placed on the market before 2027 |
| 11 Dec 2027 | All remaining obligations – products may only be placed on the market if CRA compliant |
Relevant already: the reporting obligations have applied since 11 September 2026. Manufacturers must report an actively exploited vulnerability within 24 hours (early warning) and 72 hours (notification) via ENISA’s single reporting platform; a final report follows.
Key obligations for manufacturers
- Cybersecurity risk assessment across the entire product lifecycle – documented in the technical documentation.
- Essential cybersecurity requirements, including secure default configuration, protection against unauthorised access, data integrity and a minimised attack surface.
- Vulnerability handling: identify, document and promptly fix vulnerabilities via security updates; provide a contact point for reports.
- Software bill of materials (SBOM) for the components used.
- Define a support period – as a rule at least five years unless the expected use time is shorter – and state it.
- Information for users: secure installation and commissioning, updates, end of support, contact for vulnerability reports.
- Conformity assessment, EU declaration of conformity and CE marking – CE marking will cover the CRA as well.
How it fits with the Machinery Regulation
From 20 January 2027 the Machinery Regulation (EU) 2023/1230 also requires protection against corruption: connections to other devices or remote access must not lead to hazardous situations, and safety-related software and data must be protected. The CRA adds general cybersecurity, updates and reporting duties.
In practice this means both regulations must be reflected in the risk assessment, technical documentation and instructions of a connected machine. If your documentation is structured and versioned, keeping both bodies of evidence consistent becomes much easier.
What it means for documentation
The CRA creates new content that belongs in documentation and instructions – and that may change with every update:
- Safety information on installation, network connection and remote access in the instructions
- The support period and the contact point for vulnerability reports
- Version-specific information: which software version is installed on which machine?
- SBOM and cyber risk assessment as part of the technical documentation
- Updated instructions after security-relevant updates – permanently accessible
This is where documentation generated from product data and linked to each machine’s revision pays off: safety notes come as modules from the template, changes flow into every language version automatically, and in the online catalog every customer sees exactly the state of their machine.
Roadmap: 6 steps to CRA compliance
- Inventory: which products contain connectable digital elements?
- Classify: default, important or critical product? This determines the assessment procedure.
- Set up reporting: responsibilities, 24/72-hour process, access to the ENISA platform – already mandatory.
- Adapt development: security by design, SBOM, update mechanism, support period.
- Extend documentation: risk assessment, technical documentation, user information.
- Declare conformity: assessment, EU declaration of conformity, CE marking by 11 Dec 2027.
Note: this article provides an overview and is not legal advice. The authoritative text is Regulation (EU) 2024/2847.
How well prepared are you?
Take the free readiness check: 10 questions, 3 minutes, instant result.