EU CRA for controllers, operator panels and drives
PLCs, panels and drives are default class. Your OEM customers still need the evidence.
A company that sells PLCs, HMI panels or drive controllers on their own is a manufacturer under the Cyber Resilience Act. It rarely needs a notified body, but it does need an SBOM, security updates and a reporting process.
Last reviewed:
- Applies in full
- 11 December 2027
- Early warning
- 24 hours · Art. 14(2)(a)
- Support period
- at least 5 years · Art. 13(8)
- Most common class here
- Default product
Which Cyber Resilience Act class applies to PLCs, HMIs and drive controllers?
PLCs, HMI panels and drives with a fieldbus or Ethernet port are covered by the Cyber Resilience Act (Art. 2(1)). Annex III and IV do not list them, so they are default class, self-assessed under module A. Class I applies mainly to separately sold network components and operating systems, such as a communication module, managed switch or controller OS.
Product classes
When is a controller a product under the EU CRA?
A controller, panel or drive is a product with digital elements in its own right once its manufacturer places it on the market separately and a data connection is part of its intended use (Art. 2(1) and Art. 3(1) EU CRA). Fieldbus counts as much as Ethernet, and so does a USB or service port. If none of the Art. 2 exclusions apply, the device is in scope. Firmware from the manufacturer's portal and a remote diagnostics cloud belong to the product where the device needs them for a function. Engineering software that only configures these devices belongs to the device; licensed as a standalone tool for many devices, it is a product of its own (case by case).
Spread in this sector
Pick a product
Programmable logic controller (PLC), compact or modular
Why this class
No category in Annex III or IV; self-assessment under module A, Art. 32(1) EU CRA.
Conformity route
- 1Risk assessment
- 2Self-assessment (module A)
- EU declaration of conformity + CE
Self-assessment by the manufacturer, Art. 32(1) EU CRA.
An assessment based on typical core functions. Your product's intended purpose and design decide.
All product examples as a table+
| Product | EU CRA class | Why |
|---|---|---|
| Programmable logic controller (PLC), compact or modular | Default product | No category in Annex III or IV; self-assessment under module A, Art. 32(1) EU CRA. |
| HMI operator panel or panel PC with visualisation software | Default product | Core functionality is operating and monitoring; no category in Annex III or IV. |
| Frequency inverter or servo drive with fieldbus interface | Default product | Core functionality is driving a motor; no category in Annex III or IV. |
| Safety PLC for functional safety | Default product | Default class in our assessment: functional safety protects people from the machine and is not a cybersecurity function in the Annex III sense. |
| PLC and HMI engineering software, licensed as a standalone tool | Default product | Standalone software with no Annex III category; a product with digital elements of its own. |
| Communication module or fieldbus/Ethernet interface card, sold separately | Important product, class I (Annex III) | Physical network interface under Annex III class I item 10; Implementing Regulation (EU) 2025/2392 names fieldbus explicitly. |
| Managed industrial switch | Important product, class I (Annex III) | Annex III class I item 12; Implementing Regulation (EU) 2025/2392 describes switches as having a management plane. |
Your product isn't listed? The maturity assessment gives a first classification for your own product. Start the EU CRA assessment →
Spare parts built to the same specifications as the part they replace are outside the regulation (Art. 2(6) EU CRA). Controllers placed on the market before 11 December 2027 only become subject to its requirements after a substantial modification (Art. 69(2)); Art. 14 applies to them as well under Art. 69(3). Placing on the market happens per unit, so units of the same series first supplied to distributors or customers from 11 December 2027 on must comply.
Default class
What does the default class mean for a controller manufacturer?
Default class means the manufacturer assesses the conformity of its PLC, panel or drive itself. Every applicable Annex I requirement of the Cyber Resilience Act still applies, and the machine builder will later ask for the same evidence.
Self-assessment under module A
The manufacturer checks the device and its vulnerability handling against Annex I (internal control, Annex VIII Part I EU CRA). No notified body is required.
Art. 32(1)(a) EU CRA
Technical documentation per product family
Risk assessment, software bill of materials, support period with its rationale and a description of the security functions go into the technical documentation. It stays available for ten years after placing on the market or for the support period, whichever is longer.
Art. 31, Art. 13(13), Annex VII EU CRA
EU declaration of conformity and CE marking
Each device carries the CE marking and comes with the EU declaration of conformity or a simplified version that links to the full text. Where several EU acts apply, such as the EMC or Low Voltage Directive, there is one single declaration for all of them.
Art. 13(20), Art. 28(3), Art. 30 EU CRA
Information for the integrator
The user information under Annex II also explains how an integrator can meet the requirements of Annex I and Annex VII. For a controller, the machine builder is that integrator.
Annex II point 8(f) EU CRA
Exceptions
When does a control product become class I?
Core functionality decides the class (Art. 7(1) EU CRA), and Implementing Regulation (EU) 2025/2392 holds the technical descriptions. Three cases matter for controller makers, all of them products sold on their own. Built into the device, the class stays default.
Communication module as a separate product
A fieldbus, PROFINET or Ethernet card sold on its own is a physical network interface under Annex III class I item 10. Implementing Regulation (EU) 2025/2392 lists network interface cards, controllers and adapters for Ethernet, Bluetooth, Zigbee or fieldbus by name.
Annex III class I item 10 EU CRA
Managed switches and industrial routers
Switches with a management plane and routers fall under Annex III class I item 12. An unmanaged switch does not match the implementing regulation's description, in our assessment.
Annex III class I item 12 EU CRA
Controller operating system or chip with security functions
A real-time operating system sold separately is class I item 11, a microcontroller with security-related functionalities item 14. That is the obligation of the OS or chip vendor, not of the company building them into its PLC.
Annex III class I items 11 and 14 EU CRA
Obligations
What do manufacturers of controllers and drives have to do?
Controllers and drives nearly always end up in someone else's machine. What the manufacturer has to evidence is therefore also what the machine builder asks for (Art. 13(5) EU CRA).
- 01
Secure delivery and access control
Annex I Part I(2)(b), (d) and (j) EU CRA
For example no default passwords, web server and diagnostic services only on when needed (limited attack surface), access to program and parameters only after authentication. A reset to the factory state is available.
- 02
SBOM for firmware and engineering software
Annex I Part II(1) EU CRA
The manufacturer keeps a bill of materials covering at least the top-level dependencies. If it makes the SBOM available to users, the user information says where to find it (Annex II point 9).
- 03
Security updates through a secure update path
Annex I Part I(2)(c) and (f), Part II(2) and (7) EU CRA
Vulnerabilities can be fixed through security updates, and the controller protects firmware and configuration against unauthorised changes, for example with signed updates. Where technically feasible, security updates are provided separately from functionality updates (Annex I Part II(2)).
- 04
A support period that fits the machine
The support period follows the expected use time, weighed against the other factors in Art. 13(8); five years is the floor. In automation, where controllers run as long as the machine, it is usually well above that. The manufacturer may take into account the support periods of bought-in components that provide core functions.
- 05
Reporting, and flaws in third-party components
Art. 13(6), Art. 14(1) to (4) EU CRA
Since 11 September 2026, actively exploited vulnerabilities need an early warning within 24 hours and a notification within 72 hours; severe incidents follow the same deadlines (Art. 14(3)). A flaw found in a bought-in component also goes to that component's maker.
Related regulation
Which other rules apply to controllers alongside the Cyber Resilience Act?
Machinery Regulation (EU) 2023/1230
For a standard PLC, the Machinery Regulation addresses the machine builder, who evidences its requirements on protection against corruption and safe control systems (Annex III, sections 1.1.9 and 1.2.1) with the controller maker's documents. Safety controllers and other safety components are products under the Machinery Regulation in their own right, so their maker meets both regulations. Recital 53 of the Cyber Resilience Act names the overlaps.
IEC 62443-4-1 and 4-2
Many controller makers develop to IEC 62443-4-1 and certify components to 4-2, and their content overlaps with parts of Annex I. A presumption of conformity under Art. 27 of the Cyber Resilience Act only comes from harmonised standards referenced in the Official Journal, common specifications and European certification schemes.
In practice
Where controller manufacturers typically get stuck
Long availability, short software life cycles
A PLC family ships for 15 years, while the Linux kernel or web server library inside it has a much shorter maintenance window. The support period has to reflect that, not just the hardware.
Many OEM questionnaires, each in its own format
Every machine builder sends its own questionnaire on SBOM, support period and reporting. Keeping the answers current once per product family covers most of these requests.
Replacement PLCs and moving to a new computing platform
Swapping a faulty PLC for an identical one falls under the spare-parts rule according to the EU Commission guidance (section 4.1, example 39). A new computing platform that extends the expected use time means recalculating the support period (section 5, example 56).
Unknown firmware versions in the field
Controllers run for years on the version they shipped with. To report, the manufacturer needs to know which versions are installed and be able to reach integrators with updates.
With Kunnus
How Kunnus supports controller and drive manufacturers
Kunnus covers the Cyber Resilience Act layer: classification, SBOMs, vulnerabilities and reports per product family and firmware version. Functional safety, EMC and electrical safety stay in your existing CE process.
Worked example
Example: a modular PLC family
A manufacturer sells a modular PLC with three CPU variants, I/O modules, a PROFINET communication module for retrofits and engineering software for Windows.
- 1CPU variants and I/O modulesdefault class, module A
- 2PROFINET module, sold separatelyclass I under Annex III item 10; module A only with a fully applied harmonised standard, common specification or certification at assurance level substantial or higher (Art. 32(2))
- 3Engineering softwarelicensed standalone: default class, a product of its own with its own support period
- 4Support period12 years per firmware generation, end date stated at purchase with month and year
- 5To the machine builderdeclaration of conformity, Annex II user information, SBOM on request, advisories
- 6At the endrisk assessment and technical documentation per product, SBOM per firmware version, reporting process
Illustrative assumptions. The classification of a specific product depends on its intended purpose and design.
Sectors and legal text
Which sectors does this product belong to, and where is it in the regulation?
Frequently asked questions
Does a non-IP fieldbus bring a controller into scope?+
Yes. Art. 2(1) of the Cyber Resilience Act requires a direct or indirect, logical or physical data connection to a device or network, and a fieldbus such as PROFIBUS or CANopen is one, IP or not. The controller stays default class.
Is an HMI panel running Windows or Linux a class I product?+
No. An HMI panel stays default class even with a full operating system on board. Operating systems are Annex III class I item 11, but under Art. 7(1), second sentence, of the Cyber Resilience Act integration does not make the panel an important product. The OS is class I only where its vendor places it on the market separately.
What does a controller maker have to give the machine builder?+
The machine builder needs the EU declaration of conformity and the Annex II user information: end of support, a contact point for vulnerabilities and guidance for integrators (point 8(f)). Most also ask for an SBOM and ongoing advisories to evidence their due diligence under Art. 13(5) of the Cyber Resilience Act.
Is a firmware update by a service technician a substantial modification?+
Under Art. 3(30) of the Cyber Resilience Act, a change is substantial if it affects compliance with Annex I Part I or changes the intended purpose. Security updates generally are not, according to the EU Commission guidance (section 4.3), whoever installs them. Updates that introduce new risks not covered by the risk assessment need a closer look.
Is a replacement PLC for an old machine covered by the Cyber Resilience Act?+
A replacement PLC built to the same specifications as the one it replaces and supplied for a repair is excluded by Art. 2(6) of the Cyber Resilience Act. The EU Commission guidance (section 4.1, example 39) applies this to a complete PLC too. The manufacturer should be able to show the repair purpose, for example through its after-sales channel.
Does the Cyber Resilience Act apply to controllers in medical devices or vehicles?+
Medical devices under Regulations (EU) 2017/745 and 2017/746, and motor vehicles and trailers under Regulation (EU) 2019/2144 with systems and components type-approved for them, are excluded by Art. 2(2) of the Cyber Resilience Act. A standard PLC sold on the open market stays in scope, even if some units end up there.
Which of your control products are class I?
The EU CRA assessment classifies your devices and modules in a few minutes and shows the next steps, as a first, non-binding orientation.
Further reading
Other products
More products under the EU CRA
Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal of the EU. https://eur-lex.europa.eu/eli/reg/2024/2847/oj
This page is an orientation on the Cyber Resilience Act for this kind of product, not legal advice. Whether and how the regulation applies to a specific product depends on its intended purpose and design.