If your machine contains software and you sell it in the EU, two regulations apply to you as a manufacturer. If your company is a medium or large organisation in a listed sector, a third one applies to your own networks. Machine building is a listed sector. This page gives the dates and the duties, with links to the legal texts.
Last updated 30 September 2026. This page is a summary and not legal advice.
Every product with digital elements must be secure by design. 24-hour reporting since 11 September 2026, SBOM and security updates from 11 December 2027.
Manufacturers, importers and distributors of products with digital elements.
Dates, duties and finesFrom 20 January 2027, protection against cyber threats is an essential health and safety requirement for CE marking.
Manufacturers of machinery, and whoever makes a substantial modification.
Dates, duties and finesRisk management, supply chain security and 24-hour incident reporting for organisations in critical sectors. In Italy: Legislative Decree 138/2024.
Medium and large organisations in the listed sectors, machinery manufacturing included.
Dates, duties and fines| Cyber Resilience Act | Machinery Regulation | NIS2 | |
|---|---|---|---|
| Full page | Full page | Full page | |
| Applies to | Products with digital elements | Machinery and safety components | Organisations in critical sectors |
| You are affected as | Manufacturer, importer, distributor | Manufacturer, importer, distributor, modifier | Medium or large organisation in a listed sector, machine builders included |
| Key dates | 11 Sep 2026 reporting · 11 Dec 2027 in full | 20 Jan 2027 | In force through national laws |
| Core duty | SBOM, vulnerability handling, security updates, 24-hour reporting | Protect safety software and control systems against corruption and attacks, keep logs | Risk management, supply chain security, incident reporting |
| Our product | Shield Lifecycle | Edge Shield | Edge SDN |
Seven questions about how you work today, three minutes. You get a score out of 10 and the two things to fix first, by email.
Seven questions about how you work today. Three minutes. You get a score out of 10 and what is missing for you.
Meet us at 35.BI-MU, fieramilano Rho, 13–16 October 2026