EU CRA for machine tools and production machines
Your machine is default class. The obligations still apply in full.
A CNC machine, packaging machine or robot cell with a controller and a network port falls under the Cyber Resilience Act. In most cases it does not need a notified body.
Last reviewed:
- Applies in full
- 11 December 2027
- Early warning
- 24 hours · Art. 14(2)(a)
- Support period
- at least 5 years · Art. 13(8)
- Most common class here
- Default product
Does the Cyber Resilience Act apply to machine tools?
Yes, once the machine has a controller with software and can connect to a device or network (Art. 2(1) of the Cyber Resilience Act). Machine tools and production machines are not listed in Annex III or IV, so they are default-class products. The manufacturer self-assesses under module A and meets the applicable Annex I requirements.
Product classes
When is a machine in scope of the EU CRA?
Three questions decide. Does the machine have a data connection, direct or indirect, including USB, fieldbus or a service laptop? Is it placed on the EU market? Do none of the Art. 2 exclusions apply? Then the machine is in scope. The manufacturer's condition-monitoring cloud then belongs to the machine as well, if the machine needs it for one of its functions (remote data processing, Art. 3(2)).
Spread in this sector
Pick a product
CNC machining centre, lathe or milling machine
Why this class
No category in Annex III or IV; self-assessment under module A, Art. 32(1) EU CRA.
Conformity route
- 1Risk assessment
- 2Self-assessment (module A)
- EU declaration of conformity + CE
Self-assessment by the manufacturer, Art. 32(1) EU CRA.
An assessment based on typical core functions. Your product's intended purpose and design decide.
All product examples as a table+
| Product | EU CRA class | Why |
|---|---|---|
| CNC machining centre, lathe or milling machine | Default product | No category in Annex III or IV; self-assessment under module A, Art. 32(1) EU CRA. |
| Packaging or filling machine with HMI and remote maintenance | Default product | Remote maintenance is part of the machine; its core functionality is still packaging. |
| Robot cell or assembly line sold as one unit | Default product | Whoever places the cell on the market under its own name is its manufacturer (Art. 3(13) EU CRA). |
| Injection moulding or laser cutting machine with manufacturer cloud | Default product | A cloud the manufacturer develops, or has developed, for a machine function is part of the machine (Art. 3(2) EU CRA). The customer's MES is not. |
| Remote access gateway with VPN, sold separately | Important product, class I (Annex III) | Router or VPN product under Annex III class I item 12 or item 5. Built into the machine, it does not change the machine's class. |
| Industrial firewall for cell protection, sold separately | Important product, class II (Annex III) | Annex III class II item 2 EU CRA. This concerns the firewall's manufacturer, not the machine builder who buys it in. |
Your product isn't listed? The maturity assessment gives a first classification for your own product. Start the EU CRA assessment →
A machine with no data connection at all, such as a purely mechanical press, is outside the Cyber Resilience Act. Machines placed on the market before 11 December 2027 only become subject to its requirements after a substantial modification (Art. 69(2)); Art. 14 covers them as well (Art. 69(3)). Each machine is placed on the market individually, so machines of the same line first supplied from that date on must comply.
Default class
What does the default class mean for a machine builder?
Default class means the machine builder may assess conformity itself. The class does not reduce the Annex I requirements of the Cyber Resilience Act. The risk assessment decides which product requirements of Annex I Part I(2) apply (Art. 13(3)); vulnerability handling under Part II always applies. The evidence sits with the manufacturer rather than with a notified body.
Conformity assessment under module A
The machine builder checks whether the machine and its vulnerability handling meet the requirements (internal control, Annex VIII Part I EU CRA). No notified body is required.
Art. 32(1)(a) EU CRA
Technical documentation per machine line
Risk assessment, a description of the security functions, the software bill of materials and the support period with its rationale go into the technical documentation, which stays available for at least ten years or for the support period, whichever is longer.
Art. 31, Art. 13(13), Annex VII EU CRA
EU declaration of conformity and CE marking
The machine comes with an EU declaration of conformity that names the Cyber Resilience Act, and it bears the CE marking. Where several acts apply, such as the Machinery Regulation, a single joint declaration is mandatory.
Art. 13(20), Art. 28(3) and Art. 30 EU CRA
Exceptions
When does part of a machine become class I or II?
The class follows the product's core functionality (Art. 7(1) EU CRA), and Implementing Regulation (EU) 2025/2392 holds the technical descriptions. For machines, this mostly concerns network and security components sold as products in their own right.
Integration does not change the class
A built-in industrial router or a microcontroller with security functions does not make the machine an important product. Art. 7(1), second sentence, of the Cyber Resilience Act states that integration alone does not trigger a stricter procedure.
Art. 7(1) EU CRA
Remote access gateway sold on its own
If the machine builder also sells its remote access gateway separately, for example to retrofit older machines, the gateway is a product of its own. As a router it falls under Annex III class I item 12, as a VPN product under item 5.
Annex III class I items 5 and 12 EU CRA
Managed switch or access reader as a separate product
A managed switch (item 12) or an operator login reader (item 1) placed on the market on its own is class I. A spare part built to the same specifications as the original is outside the regulation under Art. 2(6).
Annex III class I items 1 and 12, Art. 2(6) EU CRA
Own firewall or own controller operating system
An industrial firewall is class II (Annex III class II item 2), a separately marketed operating system class I (item 11). This only affects machine builders who sell such products themselves.
Annex III EU CRA
Obligations
What does a machine tool manufacturer have to do?
The machine builder is the manufacturer of the whole machine (Art. 3(13) EU CRA); for the bought-in controller, HMI and software, the due diligence duty of Art. 13(5) applies. For a typical machine that means:
- 01
Risk assessment before series release
Art. 13(2) and (3) EU CRA
The machine's cybersecurity risks are assessed and documented: remote access, network port, the USB port on the HMI, the update path. The assessment shows which Annex I requirements apply and how they are met.
- 02
Secure defaults and protected access
Annex I Part I(2)(b), (d) and (j) EU CRA
In practice, for example: individual passwords out of the factory, remote access only after authentication, services the machine does not need switched off. The machine detects and reports possible unauthorised access.
- 03
Software bill of materials and vulnerability handling
Annex I Part II(1) and (2) EU CRA
There is an SBOM for the controller, the HMI software and the edge PC. Vulnerabilities in them are assessed and fixed through security updates.
- 04
Support period that matches the service life
At least five years. The yardstick is the expected use time, weighed with the other factors in Art. 13(8) (EU Commission guidance, section 5). For a machine that runs 15 to 20 years, the support period lies well above five years.
- 05
Reporting exploited vulnerabilities
Art. 14(1) to (4) EU CRA
An actively exploited vulnerability requires an early warning within 24 hours and a notification within 72 hours to the coordinating CSIRT and ENISA; severe incidents follow the same deadlines (Art. 14(3)). The obligation has applied since 11 September 2026, including for machines already running at customer sites.
Related regulation
Which other rules apply to machines alongside the Cyber Resilience Act?
Machinery Regulation (EU) 2023/1230
The Machinery Regulation requires protection against corruption (Annex III, section 1.1.9) and safe control systems (section 1.2.1). Recital 53 of the Cyber Resilience Act names both as points where evidence can overlap. The conformity assessment procedures of both acts still apply separately.
IEC 62443
The IEC 62443 series is established for machines and controllers. A presumption of conformity under Art. 27 of the Cyber Resilience Act only comes from harmonised standards referenced in the Official Journal, common specifications or certification schemes; for a default-class machine, none of these is a precondition for self-assessment.
In practice
Where machine builders typically get stuck
Bought-in controller without an SBOM
The controller supplier ships firmware but no software bill of materials and no vulnerability notices. The machine builder needs both to meet its own obligations and should ask for them in its purchasing terms.
Support period shorter than the machine
The machine runs for 20 years, the HMI's operating system stops getting updates after eight. Until the support period ends, the manufacturer still has to be able to fix vulnerabilities, for example through a planned platform change.
Retrofits at the customer site
A retrofit with a new controller or new remote access can be a substantial modification (Art. 3(30) EU CRA), and the installed machine then needs a new assessment. An identical replacement for a faulty PLC falls under the spare-parts rule according to the EU Commission guidance (section 4.1, example 39).
Many variants
Customer-specific machines share one controller platform. To report a vulnerability, it has to be clear which software version runs in which delivered machine.
With Kunnus
How Kunnus supports machine builders
Kunnus covers the Cyber Resilience Act layer: classification, SBOMs, vulnerabilities and reports per machine line and delivered machine. Electrical safety, EMC and the Machinery Regulation stay in your existing CE process.
Worked example
Example: a line of CNC milling machines
A machine builder sells a line of 5-axis milling machines with a bought-in controller, its own HMI, remote maintenance through a built-in gateway and a cloud for condition data.
- 1Classdefault; the built-in gateway does not change that (Art. 7(1) EU CRA)
- 2Proceduremodule A, internal control; no notified body
- 3The product coversmachine, HMI software, remote maintenance, condition cloud (remote data processing, where a machine function depends on it)
- 4Support period15 years based on expected use, end date stated with month and year
- 5From the controller supplierSBOM, vulnerability notices, support commitment for the controller firmware
- 6At the endrisk assessment, technical documentation, SBOM per software version, EU declaration of conformity, CE marking, reporting process
Illustrative assumptions. The classification of a specific product depends on its intended purpose and design.
Sectors and legal text
Which sectors does this product belong to, and where is it in the regulation?
Frequently asked questions
Does a USB port make a machine a product with digital elements?+
A USB port on the HMI is enough to bring a machine into the scope of the Cyber Resilience Act, because Art. 2(1) covers indirect and physical data connections too. The port does not change the class: the machine stays default class. It still belongs in the risk assessment, for instance on who can load software through it.
Does the Cyber Resilience Act apply to a machine that only runs in the customer's plant network?+
A machine that only runs in the customer's network is in scope of the Cyber Resilience Act as soon as it can connect to a device or network (Art. 2(1)); internet access is not required. To mitigate risks, the manufacturer may restrict intended use to trusted networks if it tells users so clearly (EU Commission guidance, section 7.1, example 66).
Who is the manufacturer if we buy in a controller and build it in?+
The machine builder that places the machine on the market under its own name is the manufacturer of the whole machine (Art. 3(13) EU CRA). For the bought-in controller, the due diligence duty of Art. 13(5) applies. The controller supplier is also the manufacturer of its controller if it places that on the market separately.
Is a remote software update a substantial modification?+
A modification is substantial if it affects compliance with Annex I Part I or changes the intended purpose (Art. 3(30) EU CRA). Under the EU Commission guidance (section 4.3), a security update usually is not. New functions whose risks the original risk assessment does not cover can be.
What applies to machines delivered to Switzerland?+
The Cyber Resilience Act does not apply to machines sold in Switzerland. A Swiss machine builder supplying the EU is a manufacturer there with the same obligations. It may appoint an EU authorised representative but does not have to (Art. 18). Whoever imports the machine into the EU carries the importer obligations either way (Art. 19).
Does the Cyber Resilience Act apply to medical devices and vehicles?+
No. Medical devices and in-vitro diagnostics under Regulations (EU) 2017/745 and 2017/746, and vehicles type-approved under Regulation (EU) 2019/2144, are excluded by Art. 2(2) of the Cyber Resilience Act. A machine tool that makes parts for the medical or automotive industry is in scope, though.
Is your machine ready for the Cyber Resilience Act?
The EU CRA assessment classifies your machine in a few minutes and shows what is still missing, as a first, non-binding orientation.
Further reading
Other products
More products under the EU CRA
Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal of the EU. https://eur-lex.europa.eu/eli/reg/2024/2847/oj
This page is an orientation on the Cyber Resilience Act for this kind of product, not legal advice. Whether and how the regulation applies to a specific product depends on its intended purpose and design.