EU CRA for agricultural machinery and smart farming
Predictable support and reporting for farm machinery with a long service life.
A company selling a tractor, implement or sensor with software and a data connection under its own brand is that product's manufacturer under the Cyber Resilience Act.
Last reviewed:
- Applies in full
- 11 December 2027
- Early warning
- 24 hours · Art. 14(2)(a)
- Support period
- at least 5 years · Art. 13(8)
- Most common class here
- Default product
Are tractors and implements covered by the Cyber Resilience Act?
Tractors and implements with networked control units are within the Cyber Resilience Act in Kunnus's assessment, type-approved or not. The exclusions in Art. 2(2) cover products governed by the medical device regulations (EU) 2017/745 and 2017/746 and by vehicle type-approval under Regulation (EU) 2019/2144; type-approval of agricultural and forestry vehicles under Regulation (EU) No 167/2013 is not among them. Art. 2(5) EU CRA allows a narrower scope for other sector rules only through a Commission delegated act. The EU Commission guidance (section 9.3) names only one further regulation, (EU) No 168/2013, for vehicle components.
Product classes
Which agricultural products fall under the EU Cyber Resilience Act?
Most farm equipment is default class under the Cyber Resilience Act. Annex III and IV contain no category for tractors, implements, field robots or farm sensors, and classification follows the core function (Art. 7(1) EU CRA). A product comes into scope through a data connection to a device or network, by cable, radio or USB, within its intended or foreseeable use (Art. 2(1)). Class I applies to networking and security equipment sold separately. The classes below are Kunnus's reading of typical core functions.
Spread in this sector
Pick a product
Tractor with networked control units and a telematics module
Why this class
Classified by its traction and field work; the cellular modem counts as an integrated component (Art. 7(1), second sentence).
Conformity route
- 1Risk assessment
- 2Self-assessment (module A)
- EU declaration of conformity + CE
Self-assessment by the manufacturer, Art. 32(1) EU CRA.
An assessment based on typical core functions. Your product's intended purpose and design decide.
All product examples as a table+
| Product | EU CRA class | Why |
|---|---|---|
| Tractor with networked control units and a telematics module | Default product | Classified by its traction and field work; the cellular modem counts as an integrated component (Art. 7(1), second sentence). Product page → |
| Implement with its own control unit, such as a sprayer or seed drill | Default product | Its control unit meters spray or seed and exchanges data with the tractor. Product page → |
| Autonomous field robot | Default product | Drives and works the field on its own, controlled by software over a radio link. |
| Livestock collar or ear-tag sensor | Default product | Records animal movement or health data and radios it to the farm. |
| Soil moisture sensor or weather station on LoRa or NB-IoT | Default product | Its radio link brings it into scope; measuring is its core function. |
| Farm gateway marketed as a router or modem for internet access | Important product, class I (Annex III) | Annex III, class I, point 12 EU CRA. |
Your product isn't listed? The maturity assessment gives a first classification for your own product. Start the EU CRA assessment →
An implement driven only by switching signals is outside the Cyber Resilience Act: signals that just trigger a function or supply power are no data connection (EU Commission guidance, section 2.5). Farm management software used purely in a browser is not a product in its own right (section 2.2).
Obligations
What the Cyber Resilience Act asks of farm machinery manufacturers
- 01
Support end date at purchase
Art. 13(9) and (19) EU CRA
Buyers learn the support end date, at least month and year, at purchase (Art. 13(19) EU CRA), and any security update released within support remains available for at least ten years or for the rest of the support period, whichever is longer (Art. 13(9)).
- 02
Reporting exploited vulnerabilities and incidents
Art. 14(1)–(4) EU CRA
As of 11 September 2026, a manufacturer that becomes aware of an actively exploited vulnerability or a severe incident has 24 hours for the early warning and 72 hours for the notification (Art. 14(2) and (4) EU CRA). Submission runs through the single reporting platform, which reaches the coordinating CSIRT and ENISA simultaneously (Art. 14(1) and (3)).
- 03
Building on existing platforms after a fresh risk assessment
Art. 13(2) EU CRA; EU Commission guidance, sections 2.6–2.7
A tractor platform designed before 11 December 2027 and built afterwards can stay in production without re-engineering once a current risk assessment under Art. 13(2) EU CRA shows that its existing measures cover the risks (EU Commission guidance, section 2.7). Where legacy components keep a requirement from being met in full, the manufacturer documents that constraint and adds compensating measures (section 2.6).
- 04
Due diligence on bought-in control units
Art. 13(5)–(6) EU CRA
Due diligence under Art. 13(5) EU CRA means setting security expectations for a supplier's telematics module or terminal and verifying them in proportion to the risk, for instance against the supplier's documentation. Vulnerabilities the manufacturer discovers in such a part are reported to the part's maker, along with any fix developed in-house (Art. 13(6)).
Related regulation
How does the Cyber Resilience Act relate to the Machinery Regulation for farm equipment?
Machinery Regulation (EU) 2023/1230
Where farm machinery falls under both regulations, Recital 53 EU CRA makes it subject to the essential requirements and conformity assessment procedures of each. Evidence on protection against corruption and on the safety and reliability of control systems (Machinery Regulation, Annex III, sections 1.1.9 and 1.2.1) may serve both acts, provided the manufacturer demonstrates it.
Delegated Regulation (EU) 2022/30 under the Radio Equipment Directive
Radio telematics and field sensors remain under the delegated regulation alongside the Cyber Resilience Act until the Commission repeals or amends it. Recital 30 EU CRA places all elements of Article 3(3)(d), (e) and (f) of Directive 2014/53/EU within the essential requirements of the Cyber Resilience Act.
In practice
Where farm machinery makers get stuck
Implements from other brands
ISOBUS connects a tractor to other makers' implements. The tractor's risk assessment has to cover that interface to software the tractor maker neither writes nor maintains.
Which version a machine runs
Dealers who install software during service visits do not always report it back to the factory. An early warning lists the member states where the affected product has been made available (Art. 14(2)(a) EU CRA), which means knowing where machines running the affected version were delivered.
Finding update windows between drilling and harvest
Machines work the field all day between drilling and harvest, often with patchy mobile coverage, so security updates must fit the windows when a farm can spare them.
Suppliers end support first
Telematics suppliers can end support for a module that is still fitted to working tractors. From then until its own support period runs out, the tractor maker handles that module's vulnerabilities alone.
With Kunnus
How Kunnus supports farm machinery manufacturers
Kunnus covers the Cyber Resilience Act layer; Machinery Regulation and radio equipment evidence stays in your existing CE process.
Worked example
Worked example: two tractor series, one telematics module
Take a manufacturer with two tractor series in three power ratings each, and four implements that have their own control units. Section 7.4 of the EU Commission guidance lets variants alike in architecture, security-relevant design, purpose and risk profile share one risk assessment.
- 1Portfolio2 series × 3 power ratings + 4 implements = 10 products
- 2Shared partone supplier's telematics module in all 6 tractor variants
- 3Exploited flaw in the telematics moduleone early warning for all 6 tractor variants; implements unaffected
- 4Risk assessments6: one per series, one per implement
- 5Support end dates10, stated at purchase
Illustrative assumptions. Sharing a risk assessment depends on whether variant differences matter for security.
Products
Which products from this sector have their own page?
Frequently asked questions
Do agricultural machines need a notified body under the Cyber Resilience Act?+
Default-class tractors, implements, terminals and sensors are self-assessed by the manufacturer under module A, internal control (Art. 32(1)(a) and Annex VIII, Part I of the Cyber Resilience Act). Class I edge cases such as a farm gateway sold as a router need a notified body, via module B plus C or module H, unless a harmonised standard, common specification or European certification scheme was applied in full (Art. 32(2) EU CRA).
Is the farm cloud behind a sensor part of the product?+
The farm cloud is part of the sensor if the sensor needs it to perform one of its functions and the manufacturer designed the cloud software, or had it designed under its responsibility; that is remote data processing under Art. 3(2) EU CRA. Hosting on a third-party cloud is covered too (EU Commission guidance, section 8.3, thermostat example). The cloud modules that carry the function then belong in the sensor's risk assessment and technical documentation (section 8.2).
How long should support last for a machine expected to work beyond five years?+
The support period should match how long buyers can expect to use the machine; five years is the minimum under Art. 13(8) of the Cyber Resilience Act (EU Commission guidance, chapter 5). The reasoning goes into the technical documentation (Annex VII, point 4), drawing on reasonable user expectations and supplier support for bought-in core components.
Can security updates be delivered offline during the season?+
Offline delivery by USB stick, SD card or workshop service tool can meet the requirement in Kunnus's reading, provided the route itself is protected. Annex I, Part II, point 7 of the Cyber Resilience Act asks for secure distribution mechanisms, automatic where applicable for security updates, and names no specific channel. Point 8 requires security updates to be disseminated without delay and free of charge. Under point 2, they are to be provided separately from feature updates where technically feasible.
Does a retrofit kit turn an older machine into a new product?+
A retrofit kit brings an older machine under EU CRA requirements when it substantially modifies the machine (Art. 69(2) EU CRA). The EU Commission guidance (section 4.3) measures this by the risk profile: a new intended purpose or risks the original assessment did not cover indicate a substantial modification, and security updates as a rule do not. Where a dealer or retrofitter substantially modifies another maker's machine, it takes on manufacturer obligations, limited to the modified part when the change concerns a single component (section 4.4).
Does Art. 14 reporting apply to machines delivered before full application?+
Machines placed on the market before 11 December 2027 fall under the reporting obligations in Art. 14 of the Cyber Resilience Act, since Art. 69(3) makes reporting the exception to grandfathering. For an actively exploited vulnerability, the final report is due no later than 14 days after a corrective or mitigating measure becomes available (Art. 14(2)(c) EU CRA).
Which class do your machines and sensors fall into?
The EU CRA assessment gives a first estimate of the product class in minutes.
Further reading
Other sectors
EU CRA compliance in other industries
Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal of the EU. https://eur-lex.europa.eu/eli/reg/2024/2847/oj
This page is an orientation on the Cyber Resilience Act for this sector, not legal advice. Whether and how the regulation applies to a specific product depends on its intended purpose and design.