EU CRA for machinery and industrial automation
Know where your machine lines stand under the EU CRA, from shipment to end of support.
A machine builder that combines controllers, HMIs and remote access into its own machine becomes that machine's manufacturer under the Cyber Resilience Act, with duties that last as long as the machine line is supported.
Last reviewed:
- Applies in full
- 11 December 2027
- Early warning
- 24 hours · Art. 14(2)(a)
- Support period
- at least 5 years · Art. 13(8)
- Most common class here
- Default product
What does the EU Cyber Resilience Act require from machine builders?
A machine with a PLC, HMI or remote access is usually a default-class product under the EU Cyber Resilience Act, because Annex III and IV list neither machines nor controllers. The machine builder self-assesses it under module A and meets Annex I from 11 December 2027. Exploited vulnerabilities have been reportable since 11 September 2026, for machines already sold too.
Product classes
Which Cyber Resilience Act product class applies to a PLC, HMI or CNC controller?
A PLC, an HMI panel and a CNC controller are default-class products under the Cyber Resilience Act in most cases, because Annex III names no industrial controllers, operator panels or machines. Classification follows core functionality, so a router or firewall built into a machine leaves the machine's class unchanged (Art. 7(1) EU CRA; EU Commission guidance, chapter 6). Classes I and II matter for components a machine builder sells on their own.
Spread in this sector
Pick a product
CNC machining centre or machine tool
Why this class
No Annex III or IV category; self-assessment under module A (Art. 32(1) EU CRA).
Conformity route
- 1Risk assessment
- 2Self-assessment (module A)
- EU declaration of conformity + CE
Self-assessment by the manufacturer, Art. 32(1) EU CRA.
An assessment based on typical core functions. Your product's intended purpose and design decide.
All product examples as a table+
| Product | EU CRA class | Why |
|---|---|---|
| CNC machining centre or machine tool | Default product | No Annex III or IV category; self-assessment under module A (Art. 32(1) EU CRA). Product page → |
| Packaging or filling machine with remote maintenance | Default product | Built-in remote access is part of the machine and does not change its class (Art. 7(1), second sentence, EU CRA). Product page → |
| Robot cell or assembly line with a built-in PLC | Default product | The built-in PLC remains its maker's product, with that maker's own EU declaration of conformity. Product page → |
| Industrial robot with robot controller | Default product | No category in Annex III or IV. |
| PLC or HMI panel sold on its own | Default product | Not listed in Annex III or IV. Product page → |
| Frequency inverter or servo drive sold on its own | Default product | No category in Annex III or IV. Product page → |
| Remote-access gateway with VPN function, sold separately | Important product, class I (Annex III) | Annex III, class I, point 5 EU CRA (VPN). |
| Industrial router or managed switch | Important product, class I (Annex III) | Annex III, class I, point 12 EU CRA (routers, modems, switches). |
| Operator login reader sold separately | Important product, class I (Annex III) | Annex III, class I, point 1 EU CRA (authentication and access control readers). |
| Control-platform operating system placed on the market separately | Important product, class I (Annex III) | Annex III, class I, point 11 EU CRA (operating systems). |
| Industrial firewall for cell protection, intrusion detection system | Important product, class II (Annex III) | Annex III, class II, point 2 EU CRA; third-party assessment under Art. 32(3). |
Your product isn't listed? The maturity assessment gives a first classification for your own product. Start the EU CRA assessment →
Machines whose intended use involves no data connection to any device or network fall outside the Cyber Resilience Act (Art. 2(1) EU CRA), and so do identical spare parts made to the same specifications (Art. 2(6)). Machines placed on the market before 11 December 2027 only become subject to the requirements after a substantial modification (Art. 69(2) EU CRA). No Annex IV category describes a machine, and a built-in secure element does not pull the machine into its stricter procedure (EU Commission guidance, chapter 6, Example 63).
Obligations
Manufacturer obligations for machine builders
- 01
A support period with a stated end date
The support period is at least five years under Art. 13(8) EU CRA and reflects how long the machine is expected to be in use. Buyers see the end date, at least month and year, at the point of purchase (Art. 13(19)). Security updates ship separately from feature updates where technically feasible (Annex I, Part II, point 2) and stay available for at least ten years after release (Art. 13(9)).
- 02
Bought-in components checked before integration
Art. 13(5)–(6) EU CRA
The machine builder sets out what a supplier's PLC, HMI or router has to deliver and checks it against the supplier's security documentation or its own tests. Vulnerabilities found in a component are reported to whoever makes or maintains it; where the machine builder has developed a fix, it shares the code or documentation with them (Art. 13(6) EU CRA).
- 03
Risk assessment for controller, remote access and cloud
Art. 13(2)–(4) EU CRA, Annex VII
The risk assessment takes in the PLC, HMI, remote-access path and cloud connection, and goes into the Annex VII technical documentation. The builder's own cloud software on third-party infrastructure is remote data processing of the product, as the EU Commission guidance (chapter 8) shows for an industrial robot.
- 04
A reporting route for machines already shipped
Art. 14(2)–(3) and Art. 69(3) EU CRA
Actively exploited vulnerabilities and severe incidents go through the single reporting platform to the coordinating CSIRT and ENISA. Under Art. 14(2) EU CRA, applicable as of 11 September 2026, the early warning is due within 24 hours of the manufacturer becoming aware and the notification within 72 hours. Art. 69(3) EU CRA extends this to machines placed on the market before full application.
- 05
One declaration for the EU CRA and the Machinery Regulation
Art. 28(3) and Art. 13(13) EU CRA
Where the Machinery Regulation also applies, the machine builder issues a single EU declaration of conformity listing both acts (Art. 28(3) EU CRA). Declaration and technical documentation are kept for market surveillance for at least ten years after placing on the market, or for a longer support period (Art. 13(13)).
Related regulation
Where the Cyber Resilience Act meets other rules for machinery
Machinery Regulation (EU) 2023/1230
The Cyber Resilience Act applies alongside the Machinery Regulation, since the exclusions in Art. 2(2)–(4) EU CRA are limited to medical devices, vehicles, aviation and marine equipment.
IEC 62443
IEC 62443 is currently not listed as a harmonised standard in the Official Journal of the EU, so it gives no presumption of conformity under Art. 27(1) EU CRA.
NIS2 Directive (EU) 2022/2555
Operators in NIS2 sectors must secure their supply chain (Art. 21(2)(d) NIS2), which can bring a machine builder's security evidence into the operator's supplier checks.
In practice
Where machine builders get stuck
Shared control software
When one control platform runs across several machine lines, a flaw in a shared library affects all variants built on it, and the report has to say which shipped machines run which firmware.
PLC, HMI, drive, router: four ways to document security
When the PLC, HMI, drive and router come from four vendors, the security documentation arrives in four formats, and the assessment of that material has to be traceable for the machine it went into.
Machines outliving component support
When a machine stays in service longer than a supplier maintains one of its components, handling vulnerabilities in that component remains the machine builder's job until the machine's support period ends.
Spare part or substantial modification
In service work, a part swap or retrofit is either an identical spare or a substantial modification of the machine, and the reasoning behind that call has to stand up to market surveillance years later.
With Kunnus
How Kunnus supports machine builders
Kunnus keeps track of classification, components, supplier evidence and reports under the Cyber Resilience Act per machine and variant. Machinery Regulation, EMC and low-voltage evidence stays in your existing CE process.
Worked example
Worked example: twelve variants on one control platform
Three machine lines share one control platform, with four option packages per line. The EU Commission guidance (chapter 2) treats variants with different components or functions as separate products, so the Cyber Resilience Act sees twelve.
- 1Portfolio3 machine lines × 4 option packages = 12 products
- 2Componentsshared control software, functions per option package, HMIs and routers from two suppliers
- 3Actively exploited vulnerabilitysits in the shared control software, so all 12 variants are affected; under Art. 14(2) EU CRA the 24-hour early warning lists, per variant, the member states where it has been made available
- 4Support end dates12 dates, stated to buyers at purchase
- 5Per yeara new option package adds a 13th product with its own risk assessment, SBOM and end date, while the older support periods keep running
Illustrative assumptions. Whether variants count as separate products depends on their components, configuration and enabled functions.
Products
Which products from this sector have their own page?
Frequently asked questions
How long must a machine builder provide security updates under the Cyber Resilience Act?+
Under the Cyber Resilience Act, security updates are owed for the support period, which follows the length of time the machine is expected to be in use. Five years is the floor under Art. 13(8) EU CRA; for a machine that evidently runs longer, a flat five years is hard to defend. Moving the machine to a new cloud back-end leaves the support period as it was (EU Commission guidance, chapter 5, Example 55), while a new computing platform in the PLC means recalculating it (Example 56).
Who is the manufacturer under the Cyber Resilience Act when a machine integrates third-party PLCs, HMIs and routers?+
The machine builder is the manufacturer of the machine under the Cyber Resilience Act when it assembles third-party PLCs, HMIs and routers into a product sold under its own name (EU Commission guidance, chapter 4, Example 51). The PLC or HMI supplier stays the manufacturer of its component. The guidance treats those components as externally supplied parts whose properties the machine builder verifies on integration (chapter 7).
Is a replacement PLC a spare part under Article 2(6) of the Cyber Resilience Act?+
A replacement PLC is outside the Cyber Resilience Act when it replaces an identical component, is made to the same specifications and is clearly supplied to repair a particular machine (Art. 2(6) EU CRA). Example 39 of the EU Commission guidance (chapter 4) names a CPU unit or a complete PLC. Identical refers to security-relevant properties such as cryptography and secure boot; a changed security mechanism ends the exemption (Example 37).
When does a retrofit with a new cloud back-end turn an installed machine into a new product?+
A retrofit carried out after 11 December 2027 makes an installed machine a product newly placed on the market once it amounts to a substantial modification (Art. 69(2) EU CRA). The EU Commission guidance (chapter 4) judges that by the effect on the risk profile, such as new threat vectors or attack scenarios, and a cloud back-end that reroutes data flows can cross that line. A third party that substantially modifies someone else's machine takes on manufacturer obligations only for the modified part, provided the change does not affect the cybersecurity of the rest of the machine.
Does the Article 14 reporting obligation apply to machines delivered before full application?+
Machines placed on the market before 11 December 2027 carry one obligation from the Cyber Resilience Act regardless of later changes: Art. 14 reporting (Art. 69(3) EU CRA). That obligation applies as of 11 September 2026 and includes, besides the early warning and the notification, a final report no later than 14 days after a corrective or mitigating measure becomes available (Art. 14(2)(c) EU CRA).
Which Machinery Regulation evidence can be reused for the Cyber Resilience Act?+
Recital 53 of the Cyber Resilience Act names two requirements of the Machinery Regulation (EU) 2023/1230 where evidence can overlap: protection against corruption (Annex III, section 1.1.9) and safety and reliability of control systems (section 1.2.1). The manufacturer has to demonstrate that overlap, for instance by applying harmonised standards after a risk assessment covering those cybersecurity risks. The conformity assessment procedures of both acts still apply.
Which class do your machines fall into?
The EU CRA assessment gives a first estimate of the product class for your machine and its components in a few minutes, and suggests next steps.
Further reading
Other sectors
EU CRA compliance in other industries
Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal of the EU. https://eur-lex.europa.eu/eli/reg/2024/2847/oj
This page is an orientation on the Cyber Resilience Act for this sector, not legal advice. Whether and how the regulation applies to a specific product depends on its intended purpose and design.