EU CRA for tractors, implements and harvesters
Your tractor is default class. Its support has to last as long as the machine.
A tractor with telematics, a sprayer with an ISOBUS control unit or a combine with yield mapping falls under the Cyber Resilience Act. Type approval does not change that, and a notified body is usually not needed.
Last reviewed:
- Applies in full
- 11 December 2027
- Early warning
- 24 hours · Art. 14(2)(a)
- Support period
- at least 5 years · Art. 13(8)
- Most common class here
- Default product
Does the Cyber Resilience Act apply to tractors and farm machinery?
Yes, once the machine has control units with software and a data connection such as ISOBUS, telematics or a diagnostic port (Art. 2(1) of the Cyber Resilience Act). Type approval under Regulation (EU) No 167/2013 is not an exclusion. Farm machinery is not listed in Annex III or IV, so it is default class with module A self-assessment.
Product classes
When is farm machinery in scope of the EU CRA?
Three questions decide. Does the machine have a data connection, direct or indirect, including ISOBUS, CAN bus, Bluetooth to the terminal or the workshop diagnostic port? Is it placed on the EU market? Do none of the Art. 2 exclusions apply? Then the machine is in scope; type approval is not one of those exclusions. The manufacturer's app, as software, and its telematics cloud, as remote data processing, belong to the machine where it needs them for a function (Art. 3(2)).
Spread in this sector
Pick a product
Tractor with networked control units and a telematics module
Why this class
No category in Annex III or IV; self-assessment under module A, Art. 32(1) EU CRA.
Conformity route
- 1Risk assessment
- 2Self-assessment (module A)
- EU declaration of conformity + CE
Self-assessment by the manufacturer, Art. 32(1) EU CRA.
An assessment based on typical core functions. Your product's intended purpose and design decide.
All product examples as a table+
| Product | EU CRA class | Why |
|---|---|---|
| Tractor with networked control units and a telematics module | Default product | No category in Annex III or IV; self-assessment under module A, Art. 32(1) EU CRA. |
| Sprayer, seed drill or spreader with an ISOBUS control unit | Default product | Core functionality is applying seed, fertiliser or crop protection; the control unit exchanges data with tractor and terminal to do it. |
| Combine or forage harvester with yield mapping and cloud | Default product | The manufacturer's yield-data cloud is part of the machine where a machine function depends on it (Art. 3(2) EU CRA). |
| ISOBUS terminal or guidance system, sold separately | Default product | A product with digital elements in its own right, with no Annex III category. |
| Retrofit telematics box for machine data | Default product | Default class in our assessment, as long as collecting and sending machine data is the core functionality rather than routing traffic for other devices. |
| Farm gateway marketed as a router or modem for internet access | Important product, class I (Annex III) | Annex III class I item 12 EU CRA; Implementing Regulation (EU) 2025/2392 covers routers with or without modems. |
| Cellular modem for internet connection, sold separately | Important product, class I (Annex III) | Annex III class I item 12; Implementing Regulation (EU) 2025/2392 names cellular modems explicitly. |
Your product isn't listed? The maturity assessment gives a first classification for your own product. Start the EU CRA assessment →
An implement driven only by switching signals has no data connection under the EU Commission guidance (section 2.5) and is outside the Cyber Resilience Act. Machines placed on the market before 11 December 2027 only become subject to its requirements after a substantial modification (Art. 69(2)); Art. 14 applies to them as well under Art. 69(3). Placing on the market happens per unit, so machines of the same line first supplied to dealers or customers from 11 December 2027 on must comply.
Default class
What does the default class mean for a farm machinery maker?
Default class means the manufacturer assesses the conformity of its tractor or implement itself. Every applicable Annex I requirement of the Cyber Resilience Act still applies, including to telematics, app and cloud.
Self-assessment under module A
The manufacturer checks the machine and its vulnerability handling against Annex I (internal control, Annex VIII Part I EU CRA). No notified body is required.
Art. 32(1)(a) EU CRA
Technical documentation per machine line
Risk assessment, software bill of materials, support period with its rationale and a description of the security functions go into the technical documentation. It stays available for ten years after placing on the market or for the support period, whichever is longer.
Art. 31, Art. 13(13), Annex VII EU CRA
EU declaration of conformity and CE marking
For the Cyber Resilience Act, the manufacturer issues an EU declaration of conformity and affixes the CE marking, on top of the type approval. Where the Machinery Regulation applies as well, for example to an implement, one single declaration covers both acts.
Art. 13(20), Art. 28(3), Art. 30 EU CRA
Exceptions
When does a farm machinery product become class I?
Core functionality decides the class (Art. 7(1) EU CRA), and Implementing Regulation (EU) 2025/2392 holds the technical descriptions. In agriculture this mainly affects devices sold as an internet connection.
Built-in parts change nothing
A cellular modem or router inside the tractor does not make the tractor an important product. Art. 7(1), second sentence, of the Cyber Resilience Act states that integration alone does not trigger a stricter procedure.
Art. 7(1) EU CRA
Farm gateway sold as a router
A gateway marketed as internet access for the yard, barn or machine shed is a router under Annex III class I item 12. Marketing, manual and documentation should describe its core functionality consistently.
Annex III class I item 12 EU CRA
Cellular modem sold on its own
A modem for internet connection placed on the market separately also falls under item 12. Implementing Regulation (EU) 2025/2392 lists cellular, satellite and DSL modems as examples.
Annex III class I item 12 EU CRA
Telematics box: watch the core functionality
A retrofit box that collects machine data and sends it to the cloud stays default class in our assessment. Marketed as a Wi-Fi hotspot or router for other devices, it moves towards item 12.
Art. 7(1), Annex III class I item 12 EU CRA
Obligations
What does a tractor or implement manufacturer have to do?
The manufacturer answers for the whole machine, including bought-in control units, terminals and telematics modules (Art. 13(5) EU CRA). For a typical machine that means:
- 01
Risk assessment covering ISOBUS and workshop access
Art. 13(2) and (3) EU CRA
The risk assessment covers telematics, app, the diagnostic port and the ISOBUS link to other makers' implements, taking the operating environment and expected service life into account.
- 02
Protected remote and diagnostic access
Annex I Part I(2)(b), (d), (f) and (j) EU CRA
For example no default passwords, unused services off, remote and workshop access only after authentication, control unit software and configuration protected against unauthorised changes.
- 03
A support period spanning many seasons
The support period follows the expected use time, weighed against the other factors in Art. 13(8); five years is the floor (EU Commission guidance, section 5). For machines that run 15 to 20 years, it sits well above that. The end date is stated at purchase with month and year (Art. 13(19)).
- 04
SBOM and vulnerability handling
Annex I Part II(1) and (2), Art. 13(6) EU CRA
Control units, terminal and telematics each come with a software bill of materials. A flaw found in a bought-in module also goes to that module's manufacturer.
- 05
Reporting exploited vulnerabilities
Art. 14(1) to (4) EU CRA
An actively exploited vulnerability requires an early warning within 24 hours and a notification within 72 hours to the coordinating CSIRT and ENISA. Severe incidents follow the same deadlines (Art. 14(3)). The obligation has applied since 11 September 2026, including for machines already working on farms.
Related regulation
Which other rules apply to farm machinery alongside the Cyber Resilience Act?
Regulation (EU) No 167/2013 (type approval of agricultural and forestry vehicles)
Type approval stays mandatory and runs in parallel. Art. 2(2) of the Cyber Resilience Act only excludes vehicles under Regulation (EU) 2019/2144, not those under Regulation (EU) No 167/2013. The Commission could narrow the scope only through a delegated act under Art. 2(5).
Machinery Regulation (EU) 2023/1230
Implements and other farm machinery within the Machinery Regulation also have to meet its requirements and procedures. Recital 53 of the Cyber Resilience Act names protection against corruption and safe control systems (Annex III, sections 1.1.9 and 1.2.1) as points where evidence can overlap.
In practice
Where farm machinery makers typically get stuck
Updates between sowing and harvest
In season the machines work every day, and mobile coverage at the field edge is patchy. Security updates have to fit the weeks a farm can spare the machine, or come through the dealer workshop.
Suppliers end support sooner
The telematics module's maker stops support after a few years while the tractor keeps running. Until its own support period ends, the tractor maker carries the module's vulnerabilities alone.
Other makers' implements on ISOBUS
ISOBUS connects the tractor to implements from other manufacturers. The risk assessment has to cover that interface, even though the tractor maker neither writes nor maintains the software behind it.
Industry guidance versus your own assessment
The European agricultural machinery association CEMA has published implementation guidance on the Cyber Resilience Act (CEMA Implementation Guidance on the EU CRA, cema-agri.org). An association's reading does not replace your own documented classification per machine.
With Kunnus
How Kunnus supports farm machinery makers
Kunnus covers the Cyber Resilience Act layer: classification, SBOMs, vulnerabilities and reports per machine line and delivered machine. Type approval, the Machinery Regulation and electrical safety stay in your existing process.
Worked example
Example: a tractor line with telematics
A manufacturer sells a tractor line with an ISOBUS terminal, a built-in telematics module, an app for driver and farm manager and a cloud for machine data. A farm gateway is offered as an accessory.
- 1Tractordefault class (see above)
- 2Proceduremodule A, internal control; type approval runs alongside
- 3The product coverstractor, terminal software, telematics, app, machine-data cloud as remote data processing
- 4Farm gateway accessorya separate product, class I under Annex III item 12
- 5Support period15 years based on expected use, end date stated with month and year
- 6At the endrisk assessment, technical documentation, SBOM per control unit version, EU declaration of conformity, CE marking, reporting process
Illustrative assumptions. The classification of a specific product depends on its intended purpose and design.
Sectors and legal text
Which sectors does this product belong to, and where is it in the regulation?
Frequently asked questions
Are type-approved tractors excluded from the Cyber Resilience Act?+
No. Art. 2(2) of the Cyber Resilience Act only excludes vehicles covered by Regulation (EU) 2019/2144: cars, trucks, buses and trailers (categories M, N, O). Tractors are approved under Regulation (EU) No 167/2013, which is not on that list. If a tractor, implement or harvester has a data connection such as ISOBUS, telematics or USB, the CRA applies. The Commission could exclude agricultural vehicles by delegated act (Art. 2(5)); no such act exists so far.
Is an ISOBUS connection enough to bring an implement into scope?+
An implement with its own control unit that exchanges data with tractor and terminal over ISOBUS has a data connection under Art. 2(1) of the Cyber Resilience Act. One driven only by switching signals has none, according to the EU Commission guidance (section 2.5). The implement stays default class.
Is the manufacturer's farm app part of the machine?+
An app the manufacturer develops for a machine function, such as handling application maps, belongs to the product as software, following the same logic as the fitness wearable with its companion app (EU Commission guidance, section 2.4, example 9). The cloud behind it is remote data processing where a function depends on it (Art. 3(2) EU CRA; section 8.1).
Is a software update at the dealer workshop a substantial modification?+
Under Art. 3(30) of the Cyber Resilience Act, a change is substantial if it affects compliance with Annex I Part I or changes the intended purpose. Security updates, over the air or at the workshop, generally are not (EU Commission guidance, section 4.3). Updates that introduce new risks not covered by the risk assessment need a closer look.
Is a replacement control unit for an older tractor covered?+
A replacement control unit built to the same specifications as the one it replaces is excluded by Art. 2(6) of the Cyber Resilience Act. Under the EU Commission guidance (section 4.1), the repair purpose has to be evident from the supply context, for example a dealer order for a specific machine.
What applies to farm machinery from Switzerland?+
A Swiss manufacturer supplying tractors or implements to the EU has the same obligations under the Cyber Resilience Act as an EU maker. It may appoint an EU authorised representative but does not have to (Art. 18). Whoever imports the product into the EU carries the importer obligations under Art. 19 in any case. Sales within Switzerland are not covered.
Is your farm machinery ready for the Cyber Resilience Act?
The EU CRA assessment classifies your machines in a few minutes and shows what is still missing, as a first, non-binding orientation.
Further reading
Other products
More products under the EU CRA
Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal of the EU. https://eur-lex.europa.eu/eli/reg/2024/2847/oj
This page is an orientation on the Cyber Resilience Act for this kind of product, not legal advice. Whether and how the regulation applies to a specific product depends on its intended purpose and design.