--- title: "CRA FAQ for machine builders and importers | Edge SDN" description: "90 answers on the Cyber Resilience Act for machine builders and importers: scope, dates, spare parts, 24-hour reporting, quotes and service. Linked to the law." url: https://www.edge-sdn.com/regulations/cyber-resilience-act/faq/ last_updated: 2026-10-27 --- CRA FAQ · 90 answers · machine builders and importers # Get straight answers on the CRA for your machines The questions machine builders and importers really ask about the Cyber Resilience Act. Each one has a one-line answer, what to do next and a link to the law. Reviewed 27 October 2026· By [Aldo Campi, Edge SDN](https://www.edge-sdn.com/regulations/cyber-resilience-act/faq/#about-faq)· A summary, not legal advice ## Start where you are ### I build machines - [Does the CRA apply to my machine?](https://www.edge-sdn.com/regulations/cyber-resilience-act/faq/#q-1-1) - [What about machines already sold?](https://www.edge-sdn.com/regulations/cyber-resilience-act/faq/#q-2-2) - [What must I do from December 2027?](https://www.edge-sdn.com/regulations/cyber-resilience-act/faq/#q-4-1) - [How long must I support a machine?](https://www.edge-sdn.com/regulations/cyber-resilience-act/faq/#q-4-5) ### I import machines - [What are my obligations?](https://www.edge-sdn.com/regulations/cyber-resilience-act/faq/#q-8-1) - [Which documents do I demand?](https://www.edge-sdn.com/regulations/cyber-resilience-act/faq/#q-8-2) - [When do I become the manufacturer?](https://www.edge-sdn.com/regulations/cyber-resilience-act/faq/#q-8-5) - [Do I report to ENISA?](https://www.edge-sdn.com/regulations/cyber-resilience-act/faq/#q-8-3) ### I sell and quote - [What will buyers ask in tenders?](https://www.edge-sdn.com/regulations/cyber-resilience-act/faq/#q-6-1) - [What should my offer say?](https://www.edge-sdn.com/regulations/cyber-resilience-act/faq/#q-6-2) - [A customer wants our SBOM](https://www.edge-sdn.com/regulations/cyber-resilience-act/faq/#q-6-4) - ["Is your machine CRA compliant?"](https://www.edge-sdn.com/regulations/cyber-resilience-act/faq/#q-6-6) ### I run service - [Which machines does a new CVE hit?](https://www.edge-sdn.com/regulations/cyber-resilience-act/faq/#q-7-2) - [Must we report a new CVE?](https://www.edge-sdn.com/regulations/cyber-resilience-act/faq/#q-5-3) - [The customer refuses an update](https://www.edge-sdn.com/regulations/cyber-resilience-act/faq/#q-7-3) - [Are spare parts covered?](https://www.edge-sdn.com/regulations/cyber-resilience-act/faq/#q-3-5) - [**11 Sep 2026**](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F14)Reporting duty applies, also to machines already sold - [**20 Jan 2027**](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R1230R%2801%29)Machinery Regulation applies - [**11 Dec 2027**](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F71)CRA applies in full to every new unit ## Check if the CRA applies to your machine Almost every machine with a PLC, an HMI or a service port is in scope. Start here. ### Does the Cyber Resilience Act apply to industrial machines? **Yes, in almost every case.** Software plus any data connection puts a machine in scope. The CRA has no list of product types. It has one test: the product contains software or electronic hardware that processes data, and its intended or foreseeable use includes a direct or indirect data connection to a device or network ([Article 2(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F2)). A machine with a PLC, an HMI, a drive with a fieldbus or a service port passes that test. Machinery is not on the list of exclusions in Article 2. The machine also stays under the Machinery Regulation (EU) 2023/1230, so both laws apply ([Commission FAQ 2.4.2](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)). What to do List every machine family you sell and mark each data interface: Ethernet, fieldbus, USB, Wi-Fi, Bluetooth, modem, remote access gateway. Applies to: New machines · Machines already sold ### Our machine is never connected to the internet. Is it still in scope? **Yes.** The CRA counts any data connection, not only the internet. The CRA speaks of data connections, not of the internet. A physical connection includes cables, optical links and radio, and a logical connection includes any software interface ([Article 3(8) and 3(9)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F3)). The Commission FAQ gives "an industrial fieldbus such as PROFIBUS connecting a sensor to a programmable logic controller" and a USB cable as examples of a direct physical connection ([Commission FAQ 1.3](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)). An isolated network lowers the risk in your risk assessment. It does not take the machine out of scope. What to do Write down the operating environment you assume (isolated cell, plant network, remote access) in the risk assessment. It decides which requirements you must implement and how strongly. Applies to: New machines · Machines already sold ### Is a machine without any software in scope? **No.** Without a programmable part that exchanges data, the CRA does not apply. A purely mechanical or electromechanical machine with relays and no programmable element is not a product with digital elements ([Article 3(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F3)). As soon as you add a PLC, a smart relay, a drive with firmware or an HMI, the machine is in scope if that element can exchange data. Applies to: New machines ### We only write the PLC program. The PLC and HMI come from large vendors. Are we the manufacturer under the CRA? **Yes.** You place the whole machine on the market, so you are its manufacturer. You place the machine on the market under your name, so you are the manufacturer of the whole machine as a product with digital elements ([Article 3(13)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F3)). The PLC and HMI are components. You must exercise due diligence on them ([Article 13(5)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F13)), and you handle vulnerabilities for the machine as a whole, including its components ([Commission FAQ 4.3.6](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)). When those components are themselves placed on the market under the CRA, you can rely on their makers' own duties, for example to produce a patch. Applies to: New machines ### We build one-off special machines and lines. Does the CRA apply to single units? **Yes.** The law applies to each unit, one-off or series. Tailor-made machines get two small reliefs. EU product law applies to each individual product, whether it was made as a single unit or in series ([Blue Guide 2022, sections 2.2 and 2.3](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52022XC0629%2804%29)). One-off machines get one relief: for a tailor-made product fitted to a particular purpose for a particular business user, you and the customer may explicitly agree to deviate from two requirements, the secure default configuration and free security updates ([Annex I](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx%5FI), recital 64). All other duties stay. See question [6.3](https://www.edge-sdn.com/regulations/cyber-resilience-act/faq/#q-6-3). Applies to: New machines ### Is a machine we build for use in our own factory in scope? **No, not under the CRA.** Own use is not placing on the market. The Machinery Regulation still applies. Placing on the market does not take place when a product is manufactured for one's own use ([Commission FAQ 1.5](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions), citing the Blue Guide). Two warnings. The Machinery Regulation still applies to machines put into service for own use. And a machine built by a group company and sold to a sister company can count as placing on the market, because the transfer is between two legal persons. Applies to: New machines ### Is our remote service portal or cloud app part of the machine? **It can be.** A back end you built and the machine needs for a function is part of the product. The CRA covers a product "and its remote data processing solutions" ([Article 3(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F3)). Remote data processing is in scope when you designed it, or had it designed under your responsibility, and the machine cannot perform one of its functions without it ([Article 3(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F3)). Your own platform that pushes recipes, configurations or updates to the machine is a likely case. A third-party remote access service you only buy and use is not your remote data processing solution. The gateway you build into the machine is still one of its components. The guidance works through several remote data processing use cases ([C(2026) 5252](https://digital-strategy.ec.europa.eu/en/library/commission-publishes-new-guidance-support-timely-cyber-resilience-act-implementation)). What to do Draw the data flows between machine, gateway, cloud and service laptop. Mark which back ends you built and which functions depend on them. Applies to: New machines ### Our machine contains an industrial router, a managed switch or an industrial PC. Does that make it an "important product"? **No.** A router or switch inside does not change the machine's class. Most machines use self-assessment. Routers, switches and operating systems are listed as important products in [Annex III](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx%5FIII). But integrating such a product "shall not in itself render the product in which it is integrated" subject to the stricter procedures ([Article 7(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F7)). The core function of the machine decides its class ([Commission FAQ 3.2](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)). The German statutory accident insurer for metalworking reaches the same result for PLCs, drives and network interfaces ([BGHM FAQ](https://www.bghm.de/arbeitsschuetzer/themen/maschinen/faqs-cyber-resilience-act)). Most machines are default products and use self-assessment (module A). The technical descriptions of each category are in [Implementing Regulation (EU) 2025/2392](https://eur-lex.europa.eu/eli/reg%5Fimpl/2025/2392/oj/eng). Applies to: New machines ### Does the CRA apply to used machines we resell? **Only if the unit is new to the EU market.** A first import into the EU counts as placing on the market. It depends on whether the unit is already on the EU market. Placing on the market happens only once per unit across the EU ([Blue Guide 2022, section 2.3](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52022XC0629%2804%29)). A used machine already on the EU market is not placed again when you resell it. A used machine imported into the EU for the first time is placed on the market at that moment, so it must comply if that happens on or after 11 December 2027. A refurbishment that changes functions or security properties can be a substantial modification. See section 3. Applies to: New machines · Importers ## Know the dates and what they mean for machines already sold Reporting applies today. The product rules arrive on 11 December 2027. ### What are the key CRA dates for a machine builder? **11 September 2026, 20 January 2027, 11 December 2027.** Reporting now, the Machinery Regulation next, the full CRA last. Since 11 September 2026 the reporting duty of [Article 14](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F14) applies. On 20 January 2027 the Machinery Regulation applies. On 11 December 2027 the rest of the CRA applies ([Article 71(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F71)). Two more dates sit around them: Chapter IV on notified bodies applies since 11 June 2026, and the new Product Liability Directive covers products placed on the market or put into service after 9 December 2026. The reporting duty is already live for the whole installed base. The product rules start fifteen months later, on 11 December 2027, and only for units placed on the market from that day. Applies to: New machines · Machines already sold ### Do the machines we already sold have to comply with the CRA? **No for product rules, yes for reporting.** Machines already sold keep their CE marking but fall under the 24-hour duty. No for the product requirements, yes for reporting. Machines placed on the market before 11 December 2027 fall under the CRA requirements only if they are substantially modified from that date ([Article 69(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F69)). They keep their CE marking ([BGHM FAQ](https://www.bghm.de/arbeitsschuetzer/themen/maschinen/faqs-cyber-resilience-act)). But the reporting duty of Article 14 applies to all of them, including machines delivered years ago ([Article 69(3)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F69)). What to do Build a list of the connected machines you have in the field, with their main software and firmware versions. You need it to know whether an exploited vulnerability touches you. Applies to: Machines already sold ### We sell the same model before and after 11 December 2027. Which units must comply? **Every unit placed from 11 December 2027.** The rules apply to units, not to types. Every unit placed on the market on or after 11 December 2027. The rules apply to individual products, not to types. A type first sold in 2025 gives no protection to a unit sold in 2028 ([Commission FAQ 7.2](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions), [Blue Guide 2022, section 2.3](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52022XC0629%2804%29)). The Blue Guide is explicit: units of an older model "which are placed on the market after the new requirements have become applicable, must comply with these new requirements." Applies to: New machines ### We sign an order in 2027 and deliver the machine in 2028. Which date counts? **Usually the day the finished machine is transferred.** The order date does not count. Usually the date the finished machine is first transferred to the customer, not the order date. Transfer means ownership, possession or another right; physical handover is not needed. "An offer or agreement concluded before the stage of manufacture has been finalised cannot be considered as placing on the market" ([Blue Guide 2022, section 2.3](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52022XC0629%2804%29)). For a line you finish and commission at the customer's site, manufacture ends there, so that later date counts. Invoicing or transferring title of an unfinished machine before 11 December 2027 does not help. What to do For every project that may be finished after 11 December 2027, design it to the CRA now. Do not plan on a 2027 contract date to escape the rules. Applies to: New machines ### What about machines in our warehouse or at a dealer on 11 December 2027? **Units already sold to a dealer are fine.** Units still in your own stock must comply from 11 December 2027. Units already placed on the market, for example sold to a dealer or distributor, can still be sold after that date without being brought into conformity ([Commission FAQ 7.2 and 7.5](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)). Units still in your own stock, not yet supplied to anyone, have not been placed on the market. From 11 December 2027 they can only be placed if they comply. Applies to: New machines · Importers ### Will the dates move? Is there a grace period? **No.** The CRA dates have not moved and there is no grace period. No date of the CRA itself has moved, and the regulation has no grace period. What moved are proposals around it. The Commission notified a draft amendment of the standards request M/606 on 7 July 2026, with new delivery deadlines; it was not adopted as of 16 October 2026 ([our standards tracker](https://www.edge-sdn.com/regulations/cyber-resilience-act/standards/)). The Digital Omnibus proposal of 19 November 2025 would create a single entry point for incident reporting run by ENISA. It is still a proposal. Today the [ENISA Single Reporting Platform](https://portal.cra-srp.enisa.europa.eu/) is the only channel for CRA reports. Applies to: New machines · Machines already sold ## Handle the Machinery Regulation, modifications and spare parts Two laws, two meanings of "substantial modification" and a narrow spare-part exemption. ### Do we have to comply with both the CRA and the Machinery Regulation? **Yes.** Both laws apply, with their own requirements, and you sign one declaration. Yes, when the machine has digital elements. The Commission FAQ says compliance with the cybersecurity requirements of one regulation "cannot be automatically considered to also fully satisfy those of the other" ([Commission FAQ 2.4.2](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)). The Machinery Regulation protects safety: its Annex III sections 1.1.9 and 1.2.1 require protection against corruption and safe, reliable control systems ([Regulation (EU) 2023/1230](https://eur-lex.europa.eu/eli/reg/2023/1230/oj/eng)). The CRA protects data, functions and vulnerability handling over the support period. The conformity procedures of both must be followed ([Commission FAQ 2.4.3](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)). You draw up one single EU declaration of conformity that names both acts ([Article 28(3)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F28)). What to do Run one cybersecurity analysis that feeds both files, and show in each file how it covers that law's requirements. Our article [CRA or Machinery Regulation](https://www.edge-sdn.com/use-cases/cra-or-machinery-regulation/) puts the duties side by side. Applies to: New machines ### Is "substantial modification" the same in the CRA and the Machinery Regulation? **No.** The two laws define it differently. One job can be substantial under one and not the other. Under the CRA a change is substantial when it affects compliance with the essential requirements of Annex I Part I, or changes the intended purpose that was assessed ([Article 3(30)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F3)). Under the Machinery Regulation a modification is substantial only when it was not foreseen or planned by the manufacturer, it affects safety by creating a new hazard or increasing an existing risk and it requires new guards or other protective measures ([Article 3(16) of Regulation (EU) 2023/1230](https://eur-lex.europa.eu/eli/reg/2023/1230/oj/eng)). The same job can be substantial under one law and not under the other. From 11 December 2027, a substantial modification under the Machinery Regulation also requires you to consider the CRA to declare conformity ([BGHM FAQ](https://www.bghm.de/arbeitsschuetzer/themen/maschinen/faqs-cyber-resilience-act)). Applies to: New machines · Machines already sold ### We retrofit or revamp a machine in the field after 11 December 2027. Are we then responsible for full CRA compliance? **Only if the change is a substantial modification.** Run the test in writing before you quote the job. Only if the change is a substantial modification. A machine placed on the market before 11 December 2027 becomes subject to the CRA if it is substantially modified from that date ([Article 69(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F69)). A company other than the original manufacturer that substantially modifies a machine and makes it available becomes the manufacturer "for the part ... affected by the substantial modification or, if the substantial modification has an impact on the cybersecurity of the product ... as a whole, for the entire product" ([Article 22](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F22)(2)). That part-only limit applies to third parties who modify a machine and make it available. If you are the original builder, plan for the whole machine unless a guidance example clearly fits your case ([C(2026) 5252](https://digital-strategy.ec.europa.eu/en/library/commission-publishes-new-guidance-support-timely-cyber-resilience-act-implementation)). VDMA argues that rebuilds by the original machine builder should not count as substantial modifications ([VDMA](https://www.vdma.eu/de/viewer/-/v2article/render/164384966)). Treat that as an open debate, not as settled law. What to do Before you quote a retrofit, run the test in writing. Does the job change the intended purpose, add interfaces or functions or affect an Annex I requirement? Keep the answer with the job file. Applies to: Machines already sold ### Does a software update count as a substantial modification? **A security update, no. A new function, maybe.** What counts is the effect on risk, not the size of the change. A pure security update normally does not. A functional update can. The Commission's example: a bug-fix update to a product sold in 2027 does not bring it under the CRA, while a later update that adds new functions and changes the intended purpose does ([Commission FAQ 1.4](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)). The guidance adds that what counts is the effect on risk compared with the original risk assessment, not the size of the change ([C(2026) 5252](https://digital-strategy.ec.europa.eu/en/library/commission-publishes-new-guidance-support-timely-cyber-resilience-act-implementation)). A function you already assessed and shipped disabled can be enabled later without a substantial modification. What to do In the risk assessment of every new machine, describe the updates and options you plan to deliver over its life. Changes you foresaw and assessed are easier to defend later. Applies to: New machines · Machines already sold ### Are spare parts covered by the CRA? **Identical spare parts are exempt.** A successor part is a product in its own right. The CRA does not apply to spare parts that replace identical components and are made to the same specifications ([Article 2(6)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F2)). Both conditions must be met: same component and same specifications. A same-model spare shipped with different firmware may fail the second one. Recital 29 names spares for products placed before the CRA applies and spares that already passed CRA conformity assessment. A non-identical replacement part, such as a newer PLC model, is a product in its own right. It must comply if it is placed on the market from 11 December 2027 ([BGHM FAQ](https://www.bghm.de/arbeitsschuetzer/themen/maschinen/faqs-cyber-resilience-act)). Installing it does not by itself make the machine substantially modified, as long as purpose and risk stay the same. What to do Tag every spare part in your catalogue as "identical" or "successor". For successors, ask the supplier for its CRA declaration and support period. Applies to: New machines · Machines already sold ### We sell a new software package or an upgrade kit for machines already installed. Is that a new product? **It can be.** New software sold for old machines is a new product with its own support period. Software is a product under the CRA. New software that does more than fix errors, sold separately for existing machines, is a new product placed on the market, with its own support period starting on that date ([BGHM FAQ](https://www.bghm.de/arbeitsschuetzer/themen/maschinen/faqs-cyber-resilience-act)). Upgrade kits with non-identical components are new products too. It does not matter whether your service team or the customer installs them; what matters is who places them on the market. Applies to: Machines already sold ### Machines with AI functions: does the CRA assessment also cover the AI Act? **Partly.** Meeting the CRA can cover the cybersecurity part of the AI Act. Not accuracy or robustness. Under [Article 12(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F12) of the CRA, a product in scope of the CRA that is also a high-risk AI system is deemed to meet the cybersecurity requirements of Article 15 of the AI Act when it meets Annex I Parts I and II and the EU declaration of conformity shows the required level. Accuracy and robustness are not covered. [Regulation (EU) 2026/1744](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32026R1744) repeats this link in the AI Act and asks the Commission to add AI safety requirements to the Machinery Regulation by delegated acts that should apply by 2 August 2028. Applies to: New machines ## Meet the manufacturer duties for new machines What a machine placed on the market from 11 December 2027 needs. ### What exactly must we do for a machine placed on the market after 11 December 2027? **Ten things.** Risk assessment, design, components, SBOM, support, contact, file, assessment, CE, instructions. Ten things, all in [Article 13](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F13) and its annexes. 1. Assess the cybersecurity risks and document the assessment. 2. Design the machine to meet the product requirements of Annex I Part I that apply to it. 3. Do due diligence on the components you buy, including open source. 4. Draw up an SBOM, at least for top-level dependencies. 5. Set a support period and handle vulnerabilities during it (Annex I Part II). 6. Set up a single point of contact and a coordinated vulnerability disclosure policy. 7. Write the technical documentation of Annex VII. 8. Run the conformity assessment, usually module A self-assessment. 9. Draw up the EU declaration of conformity and affix the CE marking. 10. Supply the user information of Annex II with the machine. The reporting duty of Article 14 comes on top and already applies. Applies to: New machines ### What is the CRA risk assessment? Can it be part of our machinery risk assessment? **A written analysis of cyber risks for the machine's real use.** It can run with your machinery risk assessment. It is an analysis of the cybersecurity risks of the machine, based on its intended purpose, reasonably foreseeable use and conditions of use, "such as the operational environment or the assets to be protected", taking into account how long it is expected to be in use ([Article 13(3)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F13)). It must say which Annex I requirements apply and how you meet them ([Article 13(3)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F13)), and you must justify the ones that do not apply ([Article 13(4)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F13)). The CRA mandates no method ([Commission FAQ 4.1.2](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)). IEC 62443-3-2 style zone and conduit analysis is a common starting point in machine building. You can run it together with the machinery risk assessment, but each file must show how it covers its own law. Applies to: New machines ### Do we have to implement all 13 security requirements of Annex I? **No, only those your risk assessment shows apply.** Justify the others. Vulnerability handling always applies. No, only those that apply on the basis of your risk assessment, and you must justify the others ([Article 13(4)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F13), [Commission FAQ 4.1.3](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)). This filter covers the product requirements of Part I, point 2. The vulnerability handling requirements of Annex I Part II always apply. The list in [Annex I Part I](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx%5FI) covers known exploitable vulnerabilities, secure default configuration, security updates, access control, confidentiality, integrity, data minimisation, availability, impact on other devices, attack surface, exploitation mitigation, security logging and secure data deletion. Where an old fieldbus protocol cannot be secured, recital 55 allows you to treat the risk by other means, for example by limiting the intended purpose to trusted environments and telling the user. What to do For Modbus, PROFIBUS or CAN segments without security, document the compensating measures: segmentation, locked cabinets, authenticated service access. That answers the r/PLC question "is locking the cabinet good enough?" with evidence instead of a guess. Applies to: New machines ### What SBOM do we need, and do we have to give it to customers? **A machine-readable SBOM of at least the top-level components.** You do not have to give it to customers. You need a software bill of materials "in a commonly used and machine-readable format covering at the very least the top-level dependencies" ([Annex I Part II(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx%5FI)). CycloneDX and SPDX are the common formats. Germany's BSI sets detailed SBOM rules in [TR-03183](https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Standards-und-Zertifizierung/Technische-Richtlinien/TR-nach-Thema-sortiert/tr03183/TR-03183%5Fnode.html), which BGHM recommends. You do not have to publish it or hand it to users: "Manufacturers should not be obliged to make the SBOM public" ([recital 77](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#rct%5F77)). If you share it, the user information says where to find it ([Annex II, point 9](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx%5FII)). If you choose to share it, the user information says where ([Annex II point 9](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx%5FII)). A market surveillance authority can ask for it with a reasoned request ([Annex VII point 8](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx%5FVII)). What to do Keep the SBOM per delivered machine, not only per model. Two units of the same model often run different firmware. Applies to: New machines ### How long must the support period be for an industrial machine? **At least five years, longer if the machine lives longer.** Industrial machines usually do. At least five years, and longer if the machine is expected to be used longer ([Article 13(8)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F13)). The law names industrial settings explicitly: "products with digital elements intended for use in industrial settings, such as industrial control systems, are often in use for significantly longer periods of time" (recital 60). Five years is a floor, not a default ([Commission FAQ 4.5.1 and 4.5.2](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)). You may weigh proportionality, the support periods of the core components you buy and the availability of the operating environment. You must state the end date, at least month and year, at the time of purchase ([Article 13(19)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F13)), and record your reasons in the technical documentation. What to do Set the support period per machine family with a written rationale: typical service life, PLC and OS vendor support, your service capacity. Put the end date in the offer and the manual. Applies to: New machines ### When does the support period start for a model we sell for ten years? **On the day each unit is placed on the market.** The last unit you sell sets the last end date. On the day each unit is placed on the market. The Commission FAQ gives the example of a batch sold in January 2028 with support until January 2033, and a second batch of the same model placed in 2030 that needs its own support period ([Commission FAQ 4.5.3](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)). The last unit you sell sets the last end date for that model. Applies to: New machines ### Must security updates be free of charge? **Yes, during the support period.** New functions can still be charged. Yes, during the support period, unless you agreed otherwise with the business user for a tailor-made product ([Annex I Part II(8)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx%5FI), recital 64). Where technically feasible, security updates must be separate from functionality updates ([Annex I Part II(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx%5FI)), so you can still charge for new features. Each security update must stay available for at least 10 years after release, or the rest of the support period if longer ([Article 13(9)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F13)). Applies to: New machines ### Do our machines need automatic updates? **No, not where updates could disturb production.** You still need a secure way to deliver them. Not when automatic updates could disturb production. The automatic update requirement does not apply to products "for which users would not reasonably expect automatic updates, including products ... intended to be used in professional ICT networks, and especially in critical and industrial environments where an automatic update could cause interference with operations" (recital 56, [Commission FAQ 4.3.3](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)). You must still provide a secure way to distribute updates and inform users without delay ([Annex I Part II(7) and (8)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx%5FI)). Applies to: New machines ### Do we have to patch every vulnerability found during the support period? **No.** Fix what matters for the risk. A patch is one remedy among several. You must address and remediate vulnerabilities "without delay" and "in relation to the risks posed" ([Annex I Part II(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx%5FI)). A patch is one remedy. Others are workarounds, configuration guidance or disabling a feature ([Commission FAQ 4.3.1](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)). The Commission's example: a vulnerable library whose functions are never called may only need to be documented and removed in the next regular release. In a machine, a vulnerable service that no network path can reach is a similar case, but you must show that the path is really closed. What to do Record a decision for every relevant CVE: affected or not, why and the remedy. This is a VEX statement. See question [7.2](https://www.edge-sdn.com/regulations/cyber-resilience-act/faq/#q-7-2). Applies to: New machines ### What technical documentation do we need, and how long do we keep it? **The file listed in Annex VII.** Keep it 10 years or the support period, whichever is longer. The content is listed in [Annex VII](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx%5FVII): product description and software versions, design and system architecture, vulnerability handling processes with the SBOM and the disclosure policy, the risk assessment, the support period rationale, standards or other solutions applied, test reports and the declaration of conformity. Keep it, and the declaration, for at least 10 years after the machine is placed on the market or for the support period, whichever is longer ([Article 13(13)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F13)). Applies to: New machines ### What must the user instructions contain? **Security information listed in Annex II.** Contact, support end date, secure setup, updates and decommissioning. The minimum is in [Annex II](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx%5FII): your contact details, the single point of contact for vulnerabilities, product identification, intended purpose and security environment, foreseeable risks, the type of support and the end date of the support period, instructions for secure commissioning, how changes affect security, how to install updates, secure decommissioning and, for components, the information an integrator needs. Keep the instructions available for 10 years or the support period, whichever is longer ([Article 13(18)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F13)). Applies to: New machines ### Do we need a vulnerability contact and a disclosure policy? **Yes.** A single point of contact and a coordinated disclosure policy. You must designate a single point of contact that users can reach by the means they prefer, "not limited to automated tools" ([Article 13(17)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F13)). You must publish a contact address for vulnerability reports and enforce a coordinated vulnerability disclosure policy ([Annex I Part II(5) and (6)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx%5FI)). A security.txt file following [RFC 9116](https://datatracker.ietf.org/doc/html/rfc9116) is the usual way to make the contact findable. Applies to: New machines ### Are there exemptions for small and medium-sized machine builders? **No exemption, three reliefs.** Simpler documentation, lower notified-body fees and national help. There is no size threshold. Three reliefs exist. Micro and small enterprises may use a simplified technical documentation form ([Article 33(5)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F33)). Notified-body fees must be reduced in proportion for SMEs ([Article 32(6)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F32)). Member States should, where appropriate, offer micro and small enterprises training, a help channel and support for testing, and may set up regulatory sandboxes ([Article 33](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F33)). On fines, Article 64(10) and recital 120 aim to spare micro and small enterprises from fines for missing the 24-hour early warning. The article's cross-reference does not cover paragraph 2, where Article 14 fines sit, so check your national law ([Article 64](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F64)). The 72-hour notification and the final report apply in full. ENISA offers free tools, such as the [Secure by Design and Default Playbook](https://www.enisa.europa.eu/publications/enisa-secure-by-design-and-default-playbook). Applies to: New machines ## Report exploited vulnerabilities and severe incidents The 24-hour duty that already covers every connected machine you sold. ### What must a machine builder report, to whom and by when? **Exploited vulnerabilities and severe incidents.** 24 hours, 72 hours, then a final report, through ENISA's platform. Two kinds of events: an actively exploited vulnerability in your machine, and a severe incident having an impact on its security ([Article 14(1) and (3)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F14)). You report through the [ENISA Single Reporting Platform](https://portal.cra-srp.enisa.europa.eu/) to the CSIRT designated as coordinator, and ENISA sees it at the same time. - Early warning: within 24 hours of becoming aware. - Notification: within 72 hours of becoming aware. - Final report: within 14 days after a fix or mitigation is available (vulnerabilities), or within one month after the notification (incidents). The duty applies since 11 September 2026 ([ENISA SRP FAQ 29](https://www.enisa.europa.eu/topics/product-security/single-reporting-platform-srp/frequently-asked-questions)). Our step-by-step guide: [Report to ENISA in 24 hours](https://www.edge-sdn.com/use-cases/report-to-enisa-in-24-hours/). Applies to: Machines already sold · New machines ### Does reporting apply to machines we sold years ago? **Yes.** Reporting covers every machine on the market, also after support ends. Article 14 applies to every in-scope product on the market, including those placed before 11 December 2027 ([Article 69(3)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F69)). It also continues after the support period ends: vulnerability handling stops with the support period, reporting does not (guidance C(2026) 5252, paragraph 210). There is one relief. You do not have to report retrospectively an exploitation you already knew about before 11 September 2026 ([ENISA SRP FAQ 13](https://www.enisa.europa.eu/topics/product-security/single-reporting-platform-srp/frequently-asked-questions)). Applies to: Machines already sold ### A CVE is published for the PLC or HMI in our machine. Must we report it? **Not because a CVE exists.** Only reliable evidence of malicious exploitation starts the clock. You report only an actively exploited vulnerability: one "for which there is reliable evidence that a malicious actor has exploited it in a system without permission of the system owner" ([Article 3(42)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F3)). A published CVE or proof-of-concept without evidence of malicious use does not trigger the duty. If the vulnerability is in a bought component and it is actively exploited, you report it for your machine, and the component maker also reports it if its component was placed on the market ([Commission FAQ 5.4](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)). If the vulnerability cannot be exploited in your machine, it is not actively exploited in your product and needs no mandatory report. For machines placed on the market from 11 December 2027 you must still tell the component maker about it, and it is good practice for older machines too ([Article 13(6)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F13)). What to do Watch the exploitation signals, not only new CVEs. The [CISA Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), the [European Vulnerability Database](https://euvd.enisa.europa.eu/) and vendor advisories are the usual first sources. Then check which delivered machines contain the component and whether the vulnerable part is reachable. Applies to: Machines already sold · New machines ### When does the 24-hour clock start? **When you have reliable evidence of exploitation.** A customer, an agency or your own service team can bring it. When you become aware, meaning you have reliable evidence of exploitation. The Commission lists typical ways: a customer reports unusual activity, a threat intelligence report, a government agency, an ethical hacker, your own telemetry ([Commission FAQ 5.1](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)). The CRA does not oblige you to monitor every channel. But you must have a single point of contact and a disclosure policy, so reports will reach you. A service technician who sees an attack on a customer's machine is a typical way for a machine builder to become aware. What to do Write a one-page procedure. Who receives the signal, who decides within hours, who files. Include weekends and holidays. Applies to: Machines already sold · New machines ### Who files the report in our company, and how do we register? **A person you appoint, with an EU Login account.** Set up two people now, register when you need to file. A person you appoint as Assigned Representative. Each needs a personal EU Login account with multi-factor authentication. One Primary Assigned Representative and up to 20 Secondary ones can be linked to your company ([ENISA SRP FAQ 9](https://www.enisa.europa.eu/topics/product-security/single-reporting-platform-srp/frequently-asked-questions)). ENISA advises registering only when you need to file, since registration takes a few minutes if the EU Login account exists. The platform is in English only and has no API, so reports are typed in the web interface. What to do Create the EU Login accounts now for two people, and do one dry run with the [ENISA user manual](https://www.enisa.europa.eu/topics/product-security/vulnerability-services/eu-incident-response-and-cyber-crisis-management/single-reporting-platform-srp/cra-srp-ar-user-manual). Applies to: Machines already sold · New machines ### Which CSIRT do we report to? **The CSIRT of the country where you decide on product security.** A wrong choice can invalidate the report. The CSIRT designated as coordinator of the Member State where your main establishment is, meaning where cybersecurity decisions on your products are mainly taken ([Article 14(7)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F14)). If that cannot be determined, the Member State with most of your EU employees. Choosing the wrong CSIRT can invalidate the report ([ENISA SRP FAQ 18](https://www.enisa.europa.eu/topics/product-security/single-reporting-platform-srp/frequently-asked-questions)). ENISA keeps the [list of CSIRTs designated as coordinators](https://www.enisa.europa.eu/topics/product-security/vulnerability-services/eu-incident-response-and-cyber-crisis-management/single-reporting-platform-srp/list-of-csirts-designated-as-coordinators). Applies to: Machines already sold · New machines ### We are a machine builder outside the EU. Where do we report? **It depends on your EU partners.** The law sets an order: representative, importer, distributor, users. First, the Member State of your authorised representative for the largest number of your products. If none, the Member State of the importer placing most of your products. Then the distributor, then the Member State with most of your users ([Article 14(7)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F14)). The duty is yours as manufacturer. Your importer does not report for you. Applies to: Machines already sold · New machines ### What counts as a severe incident for a machine? **An incident that hits the security of your machine.** Malware at a customer's plant is not automatically one. An incident is severe when it affects or can affect the machine's ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions, or when it leads or can lead to malicious code running in the machine or in the user's systems ([Article 14(5)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F14)). Malware at a customer's plant is not automatically a severe incident of your machine. The question is whether it affects the security of your product. Applies to: Machines already sold · New machines ### Do we also have to inform our customers? **Yes.** Inform impacted users and tell them what they can do. After becoming aware, you must inform the impacted users, and where appropriate all users, about the vulnerability or incident and the measures they can take, where appropriate in a structured, machine-readable format ([Article 14(8)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F14)). If you do not do it in time, the CSIRT may inform them. CSAF is the common machine-readable format for security advisories in industrial automation; BSI and BGHM recommend it ([BSI on CSAF](https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Industrielle-Steuerungs-und-Automatisierungssysteme/CSAF/CSAF%5Fnode.html)). Applies to: Machines already sold · New machines ### What happens if we miss a reporting deadline? **Fines up to EUR 15 million or 2.5% of turnover.** Small firms may get relief on the 24-hour step. Check national law. Breaches of Article 14 can be fined up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher ([Article 64(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F64)). Member States set the actual rules. Article 64(10) and recital 120 aim to spare micro and small enterprises from fines for missing the 24-hour early warning, but its cross-reference does not cover paragraph 2, so check national law. The 72-hour notification and the final report apply in full ([Article 64(10)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F64)). Applies to: Machines already sold · New machines ## Prepare quotes, tenders and contracts (pre-sale) What buyers ask now and what your offer should say. ### What security questions will customers ask in tenders and RFQs? **More and more, and often already now.** NIS2 customers must check their suppliers. More and more, and often before the CRA applies. Many of your customers fall under NIS2. They must manage "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers" and weigh their suppliers' secure development practices ([NIS2 Article 21(2)(d) and 21(3)](https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng)). In practice they send questionnaires. The usual items are an SBOM, the support period, the update and patch policy, a vulnerability contact, remote access design, network requirements of the machine and IEC 62443 alignment. What to do Prepare one standard security pack per machine family: product security sheet, network and port list, remote access description, support period, update policy, disclosure policy and contact, SBOM on request under NDA. Answer every questionnaire from that pack. Applies to: New machines · Machines already sold ### What should our offer say about cybersecurity? **The support end date and your update terms.** Plus what the customer must provide. For machines placed on the market from 11 December 2027, the end date of the support period must be clear "at the time of purchase", with at least month and year ([Article 13(19)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F13)). The offer is the natural place. Also state these points. - which updates are free (security updates during the support period) and which are paid (new functions, on-site work) - how updates are delivered and who installs them - what the customer must provide: network segment, firewall rules, accounts for remote access - how remote access works and how the customer controls it - the single point of contact for vulnerabilities - that the declaration of conformity will name the CRA and the Machinery Regulation What to do Add a short "Cybersecurity and support" clause to your offer template now. It also helps for machines delivered before 2027, because NIS2 customers ask the same questions. Applies to: New machines ### Can we agree with a customer to deviate from the secure default configuration or from free updates? **Only for a tailor-made machine.** And only on secure defaults and free updates, by explicit agreement. Only for a tailor-made machine, and only for those two requirements. A product is tailor-made when it is fitted to a particular purpose for a particular business user and both parties have explicitly agreed different contractual terms ([Commission FAQ 4.2.5](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions), recital 64). The Commission mentions products built for a specific customer's closed or air-gapped environment. A standard machine with minor options is not tailor-made. All other requirements stay, and you must keep evidence in the technical documentation that the machine is tailor-made. Applies to: New machines ### A customer wants the SBOM written into the contract. Must we agree? **No.** The CRA does not oblige you to share the SBOM. Many builders do, under NDA. The CRA does not oblige you to give the SBOM to customers. It encourages sharing it, because buyers and operators benefit, but says manufacturers "should not be obliged to make the SBOM public" ([recital 77](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#rct%5F77)). If you share it, the user information says where to find it ([Annex II, point 9](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx%5FII)). Many machine builders agree to share it under confidentiality, since it maps the attack surface. If you agree, fix the format (CycloneDX or SPDX), the depth, when you send an updated version and whether you also provide VEX statements. Applies to: New machines ### Who pays for security updates after the warranty ends? **You pay for the update itself.** On-site work can be a paid service. Check it with your lawyer. You do, for the update itself, until the end of the support period. Security updates must be provided free of charge during the support period ([Annex I Part II(8)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx%5FI)), and the support period is not the warranty period. The CRA does not make you responsible for installing updates at the customer's site ([Commission FAQ 4.3.3](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)), so on-site labour can be a paid service. Agree this in the contract and check it with your lawyer. Functional upgrades can be charged. If the only adequate fix is replacing a component, that is a corrective measure you owe under Article 13(21), not a paid upgrade. Applies to: New machines ### A customer asks today: "Is your machine CRA compliant?" What can we honestly answer? **Tell the truth about dates and evidence.** There is no CRA certificate for machines. Show readiness instead. Tell the truth about dates and evidence. For machines placed on the market before 11 December 2027 the CRA product requirements do not apply yet. The reporting duty already applies, and you can describe how you handle it. No harmonised standard is cited in the Official Journal yet, so no one can claim presumption of conformity today ([our standards tracker](https://www.edge-sdn.com/regulations/cyber-resilience-act/standards/)). Avoid words like "CRA certified". There is no general CRA certificate for machines. Speak of CRA readiness and show the evidence: risk assessment, SBOM, support period, disclosure policy, reporting procedure. Applies to: New machines · Machines already sold ### A customer wants 15 or 20 years of security support. Must we offer it? **Your support period must match the expected use.** For machines that is often long. Promises beyond it are a service you can price. You must set the support period to reflect the expected time in use, and industrial machines are often used much longer than five years (recital 60). The law lets you consider proportionality and the support periods of the core components you buy ([Article 13(8)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F13)). A contractual promise beyond the legal support period is a commercial choice you can price as a service contract. What to do Check the end-of-support dates of your PLC, HMI, industrial PC and operating system before you promise a date. Your support period cannot be credible if a core component loses support halfway. Applies to: New machines ### Does the CE marking or the declaration of conformity change? **Same CE marking, one declaration naming both laws.** From 11 December 2027 it also covers the CRA. The CE marking stays the same symbol. For machines placed on the market from 11 December 2027, it also signals CRA conformity, and you draw up a single EU declaration of conformity that names both the Machinery Regulation and the CRA ([Article 28(3)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F28), [BGHM FAQ](https://www.bghm.de/arbeitsschuetzer/themen/maschinen/faqs-cyber-resilience-act)). The content of the declaration is in [Annex V](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx%5FV). Applies to: New machines ### Can we shift CRA duties to the customer in the contract? **No.** The duties stay yours. A contract can define the customer's part. The duties of Article 13 and 14 are yours by law. Even an authorised representative cannot take over design, risk assessment, due diligence or vulnerability handling ([Article 18(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F18)). What a contract can do is define the customer's part: install updates you provide, keep the machine in the network environment you specify, report suspected incidents to your contact and allow remote access on agreed terms. Your conformity assumes the machine is "properly installed, maintained, used for their intended purpose ... and, where applicable, the necessary security updates have been installed" ([Article 6](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F6)). Applies to: New machines ## Run service, updates and end of support (after-sale) Where CRA duties happen over the life of the machine. Read this section with the installed base rule in mind. Free security updates, the support period and vulnerability handling are CRA duties for machines placed on the market from 11 December 2027. For machines placed earlier, the CRA asks only for reporting under Article 14; the Machinery Regulation, product liability and your contracts may still call for a fix. ### What changes for our after-sales and service department? **Service becomes where CRA duties happen.** Track installed software, watch vulnerabilities, deliver fixes, escalate fast. Service becomes the place where CRA duties are carried out over the machine's life. Vulnerability handling runs for the whole support period ([Article 13(8)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F13)), and reporting runs for the whole installed base ([Article 69(3)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F69)). In practice service must do six things. - know the software and firmware actually installed on each delivered machine - watch new vulnerabilities and exploitation signals for those components - decide for each machine whether it is exposed - deliver security updates or mitigations and advisories to customers - record what was installed, changed or refused at every intervention - escalate within hours when exploitation is suspected Applies to: Machines already sold · New machines ### We have hundreds of machine variants in the field. How do we know which ones a new CVE affects? **Only with a record per delivered machine.** Match the CVE to components, then check if it is reachable. Only with a record per delivered machine. Keep the serial number ([Article 13(15)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F13)), the SBOM of the software as shipped and as last serviced and the reachable interfaces. When a CVE appears, match it to components first, then check whether the vulnerable part can be reached through that machine's ports and protocols. Write the result as a VEX statement per machine: affected, not affected, fixed or under investigation. If only a customer setting blocks the path, the honest status is "affected" with the mitigation, not "not affected". Our use case [Same model, two machines, one exposed](https://www.edge-sdn.com/use-cases/find-which-machines-a-new-cve-exposes/) walks through the method. Applies to: Machines already sold · New machines ### The customer refuses or delays our security update. Who is responsible? **You must offer the fix and inform them.** You do not have to install it. Record their decision. You must make the update available without delay and free of charge during the support period. You must also inform the user ([Annex I Part II(8)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx%5FI)). You are not responsible for installing it at the customer's site ([Commission FAQ 4.3.3](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)). The CRA assesses conformity on the assumption that the necessary security updates have been installed ([Article 6](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F6)). Liability for damage is a separate question under the Product Liability Directive. See question [11.2](https://www.edge-sdn.com/regulations/cyber-resilience-act/faq/#q-11-2). What to do Send the update with a written advisory, and keep a record of the customer's decision. Offer a mitigation, such as network isolation, when production cannot stop for the update. Applies to: New machines ### Can we keep remote access for service? What does the CRA expect from it? **Yes.** Design it on risk: access control, logging and no unneeded interface open by default. Yes, the CRA does not ban remote access. It expects it to be designed on the basis of risk: protection from unauthorised access through authentication and access control, integrity of commands and configuration, logging of access with an opt-out for the user and a limited attack surface ([Annex I Part I(2)(d), (f), (j) and (l)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx%5FI)). The secure default rule applies too: interfaces that are not needed should not be open by default. If the remote service platform is your own and the machine needs it for a function, it is part of the product (question [1.7](https://www.edge-sdn.com/regulations/cyber-resilience-act/faq/#q-1-7)). Applies to: New machines ### What happens when the support period of a machine ends? **Vulnerability handling ends, reporting does not.** Old updates stay available and the file stays on record. Your vulnerability handling duty for that unit ends. Three things continue. The reporting duty continues (guidance C(2026) 5252, paragraph 210). Every security update you already issued must stay available for at least 10 years after release ([Article 13(9)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F13)). And the technical documentation must be kept for 10 years after placing on the market or the support period, whichever is longer. Where technically feasible, the machine should notify users that support has ended ([Article 13(19)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F13)). The CRA also suggests considering releasing the source code to companies that commit to continue vulnerability handling (recital 61). What to do Decide your end-of-support offer before the date arrives: an extended paid support contract, a retrofit or a migration path. Applies to: New machines ### A core component of our machine loses vendor support before our support period ends. What do we do? **You still have to fix the machine.** Replace the part, patch it yourself or isolate it. You still have to handle vulnerabilities for the whole machine. If a vulnerability in the unsupported component cannot be mitigated adequately, you must remediate it by other means, for example by replacing the component or developing a patch yourself ([Commission FAQ 4.3.7](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)). Network isolation that makes the vulnerable part unreachable is one form of mitigation, if your risk assessment supports it. Applies to: New machines ### What can we offer for old machines that cannot be patched? **Compensating controls.** Isolate the machine so only the flows it needs get through. The installed base is outside the CRA product requirements unless substantially modified, but your customers under NIS2 still need to reduce risk. The usual answer is to isolate the machine: a segmentation device between the machine and the plant network that allows only the flows the machine needs and blocks the rest. Check first whether adding it changes the machine in a way that counts as a substantial modification (questions [3.2](https://www.edge-sdn.com/regulations/cyber-resilience-act/faq/#q-3-2) and [3.3](https://www.edge-sdn.com/regulations/cyber-resilience-act/faq/#q-3-3)). Our use case [Protect a machine you cannot patch](https://www.edge-sdn.com/use-cases/protect-a-machine-you-cannot-patch/) describes the steps. Applies to: Machines already sold ### The customer changed the machine: new software, a connection to the MES, a third-party remote tool. Are we still responsible? **For what you delivered, yes. For their changes, generally not.** Record the configuration at handover. For the machine as you placed it on the market, yes. For the customer's changes, generally not. Your duties relate to the intended purpose and reasonably foreseeable use you assessed. A person other than the manufacturer who substantially modifies a machine and makes it available on the market becomes its manufacturer ([Article 22](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F22)(1)); a customer who modifies it only for its own use does not make it available. Your user information must explain how changes can affect security ([Annex II point 8(b)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx%5FII)). What to do Record the configuration at handover and at each service visit. Without that record you cannot show where your responsibility ends. Applies to: New machines · Machines already sold ## Import and distribute machines made outside the EU For machines made outside the EU and the companies that sell them. ### We import machines made in China, the US, Switzerland, the UK or Turkey. What are our obligations? **Place only machines that comply, and prove you checked.** Your duties start on 11 December 2027. You are the importer if you are established in the EU and place on the market a machine that carries the name or trademark of a manufacturer established outside the EU ([Article 3(16)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F3)). From 11 December 2027 you may place only machines that comply, and whose manufacturer's processes comply ([Article 19(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F19)). Before placing each unit you must ensure that the conformity assessment was carried out, the technical documentation exists, the machine bears the CE marking and comes with the declaration of conformity and the Annex II user information and the manufacturer has met its identification, contact and support period duties ([Article 19(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F19)). You must be able to prove it. Applies to: Importers ### What documents should we demand from the non-EU manufacturer before we place a machine on the EU market? **The declaration, CE marking, instructions and support end date.** Use the checklist and put it in the purchase contract. Use this checklist, built on [Article 19](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F19) and [Article 13(15) to (20)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F13). - EU declaration of conformity naming the CRA and the Machinery Regulation, in an accepted language - CE marking on the machine - Statement of the conformity assessment procedure used (module A, B+C or H) and, if relevant, the notified body certificate - Written commitment that the technical documentation exists and will be sent to authorities on request, in a language they understand - User information of Annex II in the languages of your markets, including the end date of the support period - Type, batch or serial number on each machine - Manufacturer name, postal and electronic contact on the machine or its documents - Single point of contact and disclosure policy for vulnerabilities - How the manufacturer meets the Article 14 reporting duty, and which CSIRT it reports to - How you will be informed of vulnerabilities and updates for units you placed What to do Put these items into your purchase contract as delivery conditions, with a right to stop deliveries if they are missing. Applies to: Importers ### Do importers have to report exploited vulnerabilities to ENISA? **No.** Reporting is the manufacturer's duty. You pass on what you learn. Article 14 reporting is a manufacturer duty. As importer you must inform the manufacturer without undue delay when you learn of a vulnerability, and inform the market surveillance authorities immediately if the machine presents a significant cybersecurity risk ([Article 19(5)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F19)). If the manufacturer stops operating and can no longer meet its duties, you must tell the authorities and, as far as possible, the users ([Article 19(8)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F19)). If you sell under your own brand, the reporting duty becomes yours (question [8.5](https://www.edge-sdn.com/regulations/cyber-resilience-act/faq/#q-8-5)). Applies to: Importers ### How long must we keep documents? **At least 10 years, or the support period if longer.** Keep the declaration and access to the file. At least 10 years after the machine is placed on the market, or for the support period if longer. You keep a copy of the declaration of conformity and ensure the technical documentation can be made available to authorities on request ([Article 19(6)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F19)). Your name and contact details must appear on the machine, its packaging or an accompanying document ([Article 19(4)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F19)). Applies to: Importers ### We sell imported machines under our own brand, or modify them before sale. Do we become the manufacturer? **Yes.** Your brand or a substantial modification makes you the manufacturer. An importer or distributor that places a machine on the market under its own name or trademark, or carries out a substantial modification, is considered the manufacturer and takes on Articles 13 and 14 ([Article 21](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F21)). That includes the risk assessment, the SBOM, vulnerability handling for the support period and 24-hour reporting. A white-label machine needs a contract with the real producer that gives you the technical access you will need. Applies to: Importers ### Can the non-EU manufacturer appoint an authorised representative? What can it do? **Yes, with a written mandate.** It keeps papers and talks to authorities. It cannot do the engineering. Yes, by written mandate ([Article 18](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F18)). The representative must at least keep the declaration and technical documentation for authorities, provide information on request and cooperate on corrective measures. It cannot take over the design, risk assessment, due diligence or vulnerability handling ([Article 18(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F18)). An authorised representative is not an importer: you still have your own Article 19 duties. Applies to: Importers ### We are a distributor or dealer. What must we check? **CE marking and documents, with due care.** Do not sell what you believe does not comply. Before making a machine available, check that it bears the CE marking and that the manufacturer and importer have provided the required documents, including the user information, the support period end date and their contact details ([Article 20(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F20)). If you have reason to believe it does not conform, do not sell it. Pass on vulnerabilities you learn about to the manufacturer. You do not have to bring machines placed on the market before 11 December 2027 into conformity ([Commission FAQ 7.5](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)). Applies to: Importers ### What happens to machines we import before 11 December 2027? **Units placed before 11 December 2027 are fine.** Check the date for each delivery, customs included. A unit placed on the EU market before 11 December 2027 does not have to meet the CRA product requirements unless it is later substantially modified ([Article 69(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F69)). For an imported product the date usually follows customs: the Blue Guide's example dates the placing on the market of a printer shipped to a Spanish importer to the day it was released for free circulation ([Blue Guide 2022, sections 2.5 and 2.12](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52022XC0629%2804%29)). Release for free circulation and placing on the market do not always happen at the same time, for example with direct sales to EU users, so check each delivery. Units still in transit or in a customs warehouse on 11 December 2027 must comply when they are placed. The manufacturer's reporting duty applies to all of them. Applies to: Importers ### What fines apply to importers and distributors? **Up to EUR 10 million or 2% of turnover.** Higher if you count as the manufacturer. Breaches of the importer and distributor duties of Articles 18 to 23 can be fined up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher ([Article 64(3)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F64)). An importer that becomes the manufacturer under Article 21 faces the manufacturer level: EUR 15 million or 2.5%. Applies to: Importers ## Work with suppliers of PLCs, HMIs, drives and software PLCs, HMIs, drives, industrial PCs and open source. ### May we only build in components that are CRA compliant and CE marked? **No.** Any component is allowed if you do due diligence. The CRA does not require CE-marked components. You may integrate components placed on the market before the CRA applies, components never placed on the market and open-source software, provided you exercise due diligence so they do not compromise your machine ([Article 13(5)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F13), [Commission FAQ 4.4.3 and 7.3](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)). VDMA reports this as the most frequent question from its members after scope, with the same answer ([VDMA podcast](https://derindustriepodcast.podigee.io/81-cra)). CE-marked components make your life easier, because you can rely on their makers' vulnerability handling. Applies to: New machines ### What does due diligence on a component mean in practice? **Checks that fit the risk of the component.** Updates, known vulnerabilities, SBOM, support period, supplier posture. It is proportionate to the risk of the component ([Commission FAQ 4.4.2](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)). The Commission lists actions such as checking the CE marking, checking the security update history, looking up known vulnerabilities in public databases, reviewing the component's SBOM, checking its support period, verifying that its intended purpose fits your use, assessing the supplier's security posture and extra tests like penetration testing or firmware analysis for high-risk parts. Applies to: New machines ### What should we ask our component suppliers? **Evidence, not promises.** Support period, SBOM, advisories, update history and integration notes. A good request covers these items. - Support period and end-of-support date of the exact model and firmware - SBOM in CycloneDX or SPDX, or the conditions to get it - Vulnerability disclosure policy, security contact and how advisories are published (CSAF if possible) - Security update history for the last years - Integration information under [Annex II point 8(f)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx%5FII): what you need to keep the component secure inside your machine - CRA conformity plans and the standards they follow, such as IEC 62443-4-1 and 4-2 VDMA publishes a recommendation for a supplier self-declaration on the CRA ([VDMA, Lieferantenselbstauskunft](https://www.vdma.eu/viewer/-/v2article/render/160097106)). Applies to: New machines · Machines already sold ### A vulnerability is found in a supplier's PLC firmware. Who fixes it? **Its maker, if the PLC is under the CRA.** You still handle it for your machine and inform your users. If the PLC was placed on the market under the CRA, its maker must handle the vulnerability, and you can rely on that, for example on its patch. You still handle it for your machine: inform users, provide mitigations, update documentation ([Commission FAQ 4.3.6](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)). If the component is older or its maker does not help, you must find another remedy, such as disabling the function, replacing the component or isolating it. When you find a vulnerability in a component you must report it to its maker or maintainer, and share any fix you develop ([Article 13(6)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F13)). Applies to: New machines · Machines already sold ### We use open-source software, such as Linux, OPC UA stacks or Node-RED, in our HMI. What does that mean? **You are responsible for it inside your machine.** Put it in the SBOM and share your fixes upstream. You are responsible for it inside your machine. Open-source components are allowed, with due diligence ([Commission FAQ 4.4.4](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)). They belong in your SBOM and in your vulnerability monitoring. Fixes you make must be shared with the maintainers ([Article 13(6)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F13)). Open-source projects supplied outside a commercial activity are not themselves under the CRA, and open-source stewards have lighter duties from 11 December 2027 ([Article 24](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F24)). Applies to: New machines ### We also sell control cabinets, HMIs or software separately. Are those separate products? **Yes, when sold on their own.** Identical spare parts are the exception. Yes, when you place them on the market separately. A component sold on its own is a product with digital elements with its own CRA duties ([Article 3(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F3)). If you sell it only as an identical spare part for a machine, the spare parts exemption applies ([Article 2(6)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F2)). If you supply components to other machine builders, they will ask you the questions in 9.3. Applies to: New machines ### Can we keep using components from stock bought before the CRA applied? **Yes, with due diligence.** The finished machine must comply as a whole. Yes, if your risk assessment finds no specific risk and the finished machine complies as a whole. The Commission accepts components without the CE marking when you exercise due diligence ([C(2026) 5252](https://digital-strategy.ec.europa.eu/en/library/commission-publishes-new-guidance-support-timely-cyber-resilience-act-implementation)). During the transition, you cannot check the CE marking of components, so due diligence must use other means (recital 35, [Commission FAQ 7.3](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)). Applies to: New machines ## Choose standards and the conformity route Where standards stand and which route your machine takes. ### Are there harmonised standards for the CRA yet? **Not in the Official Journal yet.** Assess against Annex I directly. Standards will simplify later. As of 16 October 2026 no CRA standard is cited, so no product can claim presumption of conformity under [Article 27](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F27) ([Commission harmonised standards page](https://single-market-economy.ec.europa.eu/single-market/goods/european-standards/harmonised-standards%5Fen)). The first horizontal standards are close. EN 40000-1-2 (principles, risk management and lifecycle) and EN 40000-1-1 (vocabulary) closed their formal vote and have ratification planned for November 2026 ([CEN-CENELEC JTC 13 work programme](https://standards.cencenelec.eu/ords/f?p=205:22:::::FSP%5FORG%5FID,FSP%5FLANG%5FID:2307986,25)). The vulnerability handling standard prEN 40000-1-3 comes next. The generic security requirements, prEN 40000-1-4, are due in 2027. Our [standards tracker](https://www.edge-sdn.com/regulations/cyber-resilience-act/standards/) follows all of them. What to do Plan 2027 machines on a direct assessment against Annex I. Treat harmonised standards as a later simplification. Applies to: New machines ### Does IEC 62443 make our machine CRA compliant? **Not by itself.** It is the best framework to structure your work and map to the CRA. Not by itself, but it is the closest framework for machine builders. IEC 62443-4-1 (secure development lifecycle) and 4-2 (component requirements) map well to many CRA requirements. CRA-related amendments to EN IEC 62443-4-1 and 4-2 are under approval, but are unlikely to be cited in the Official Journal. The OT security profiles of CLC/TC 65X (prEN 50770 series, based on IEC 62443) are still being drafted. Use IEC 62443 to structure your work and your evidence, then map it explicitly to each Annex I requirement in the technical documentation ([Annex VII point 5](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx%5FVII)). Applies to: New machines ### Which conformity assessment route applies to a machine? Do we need a notified body? **Usually self-assessment, no notified body.** Separate components you sell may need one. A machine is usually a default product, so you may use internal control, module A ([Article 32(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F32)). A notified body is needed for important class I products when you do not fully apply a harmonised standard, for class II products and for critical products ([Article 32(2) to (4)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F32)). This is the CRA route only. Machinery listed in Annex I of the Machinery Regulation may still need a notified body under that regulation. The CRA route matters if you also sell components such as industrial routers, switches or firewalls as separate products. Notified bodies can be designated since 11 June 2026, but the Commission said on 31 July 2026 that the NANDO register will list CRA bodies "once available" ([Commission, CRA conformity assessment](https://digital-strategy.ec.europa.eu/en/policies/cra-conformity-assessment)). Applies to: New machines ### Which ETSI and CEN-CENELEC drafts are relevant for components in our machines? **The ETSI drafts for routers, firewalls and operating systems.** They bind your suppliers, not your machine. The 17 ETSI vertical drafts in the EN 304 6xx series opened public enquiry on 13 August 2026 ([ETSI](https://www.etsi.org/newsroom/press-releases/etsi-launches-approval-process-for-17-european-standards-supporting-the-cyber-resilience-act)). Those closest to machine builders are routers and switches (EN 304 627), firewalls and intrusion detection (EN 304 636), network interfaces (EN 304 625), operating systems (EN 304 626) and hypervisors (EN 304 635). They apply to the component makers, not to your machine. Ask your suppliers which drafts they align with. Applies to: New machines ### Who will check our machines, and what will they ask for? **National market surveillance authorities.** ACN in Italy (draft decree), BSI in Germany. Italy's draft decree, approved in preliminary examination on 2 October 2026, names the national cybersecurity agency ACN as market surveillance authority ([Italian Government, Council of Ministers press release 191](https://www.governo.it/it/articolo/comunicato-stampa-del-consiglio-dei-ministri-n-191/32740)). Germany's Bundestag adopted its CRA law on 15 October 2026 with the BSI as authority ([our news item](https://www.edge-sdn.com/regulations/cyber-resilience-act/news/2026-10-germany-bundestag-passes-cra-law-bsi/)). On a reasoned request you must provide all information and documentation needed to show conformity, in a language the authority understands ([Article 13(22)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F13)). A request can follow a reported vulnerability, a complaint or a routine check. Applies to: New machines · Machines already sold · Importers ## Understand fines, liability and NIS2 Fines, recalls, product liability and NIS2. ### What are the fines under the CRA? **Up to EUR 15 million or 2.5% of turnover.** Three levels, set as maximums. Three levels, set as maximums in [Article 64](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F64). Member States set the national rules. | Breach | Maximum fine | | ------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ | | Essential requirements of Annex I, manufacturer duties of Articles 13 and 14 | EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher | | Other duties, including importers, distributors, declaration, CE marking, technical documentation | EUR 10 million or 2% | | Incorrect, incomplete or misleading information to authorities or notified bodies | EUR 5 million or 1% | Authorities must consider the size of the company, especially for SMEs ([Article 64(5)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F64)). Fines can come on top of withdrawal or recall orders. Applies to: New machines · Machines already sold · Importers ### How does the CRA relate to product liability? **Separate laws, linked.** A missing update can become a liability question. The new Product Liability Directive treats software as a product and applies to products placed on the market or put into service after 9 December 2026 ([Directive (EU) 2024/2853](https://eur-lex.europa.eu/eli/dir/2024/2853/oj/eng)). The Commission FAQ explains that the manufacturer "remains liable for any defects introduced through an update or upgrade" and for defects that arise "due to the lack of an update or upgrade" ([Commission FAQ 2.3.1](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)). Defectiveness takes cybersecurity requirements into account. A missing security update can therefore become a liability question, not only a CRA question. For machines sold to businesses, claims under the Directive mainly concern personal injury. Damage to property or data used only for professional purposes is not compensated under it, but contract and national law still apply. What to do Keep proof of every update you released and every advisory you sent. It is your best defence in both regimes. Applies to: New machines ### Can an authority force us to withdraw or recall machines? **Yes, as a last resort.** Usually for a severe flaw you cannot fix or mitigate. If you know a machine does not conform during the support period, you must take corrective measures, or withdraw or recall it ([Article 13(21)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F13)). The Commission expects recall only in exceptional cases, typically a severe hardware vulnerability that cannot be fixed or mitigated ([Commission FAQ 4.3.4](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)). Market surveillance authorities can order the same measures under Articles 54 to 58. Applies to: New machines ### Does NIS2 apply to us as a machine builder? **Possibly, and separately.** NIS2 covers your company's own systems. The CRA covers what you sell. NIS2 covers medium and large companies in listed sectors. Manufacture of machinery and equipment (NACE C28) is one of them, in the manufacturing sector of [Annex II of Directive (EU) 2022/2555](https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng). NIS2 is about securing your own company's systems and reporting incidents that affect your services. The CRA is about the products you sell. A machine builder can face both. In Italy NIS2 is transposed by Legislative Decree 138/2024. Our [NIS2 page](https://www.edge-sdn.com/regulations/nis2/) summarises who is covered. Applies to: New machines · Machines already sold ### Is a CRA breach also a Machinery Regulation problem? **It can be.** A cyber weakness that can corrupt safety functions touches both laws. The two regulations have separate requirements, but they share the CE marking and one declaration of conformity ([Article 28(3)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F28)). A cyber weakness that can corrupt safety functions touches Machinery Regulation Annex III sections 1.1.9 and 1.2.1 as well ([Regulation (EU) 2023/1230](https://eur-lex.europa.eu/eli/reg/2023/1230/oj/eng)). Our page on [point 1.1.9](https://www.edge-sdn.com/use-cases/machinery-regulation-point-1-1-9/) explains those duties. Applies to: New machines ## Start now: the first 90 days Ten steps and where to get help. ### What should a machine builder do in the next 90 days? **Ten steps, reporting first.** The first four protect you under the duty that applies today. The first four protect you under the reporting duty that already applies. 1. Name an owner for product security and a deputy. Create their EU Login accounts for the reporting platform. 2. Write the one-page reporting procedure: who receives signals, who decides, who files within 24 hours, weekends included. 3. Publish a vulnerability contact and a short disclosure policy, with a security.txt file on your website. 4. List the connected machines in the field with serial numbers, main components and software versions. 5. Map every machine family: interfaces, remote access, back ends you run, components that are important products. 6. Ask your PLC, HMI, drive, industrial PC and remote access suppliers for SBOMs, support periods and advisory channels. 7. Set a draft support period per machine family, with the rationale. 8. Add a cybersecurity and support clause to your offer and contract templates. 9. Prepare a standard security pack for customer questionnaires. 10. Pick one machine family to be delivered after 11 December 2027 and run a full pilot: risk assessment, Annex I mapping, SBOM, technical documentation outline. Free self-check: our [Check 2027](https://www.edge-sdn.com/check-2027/) asks seven questions on the Machinery Regulation and the CRA and shows where you stand. Applies to: Machines already sold · New machines ### Where can small machine builders get help? **Free official material and your trade association.** Commission, ENISA, VDMA, UCIMU and BGHM. The [Commission guidance C(2026) 5252](https://digital-strategy.ec.europa.eu/en/library/commission-publishes-new-guidance-support-timely-cyber-resilience-act-implementation) has 67 worked examples and was written with SMEs in mind. The [Commission FAQ](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions) answers most scope questions. ENISA publishes the [Secure by Design and Default Playbook](https://www.enisa.europa.eu/publications/enisa-secure-by-design-and-default-playbook) and runs a helpdesk for the reporting platform. Industry associations publish practical guides: [VDMA](https://www.vdma.eu/en/cyber-resilience-act) in Germany and [UCIMU](http://www.ucimu.it/news/v///cyber-resilience-act-e-regolamento-macchine-due-nuovi-documenti-operativi) in Italy. The German accident insurer [BGHM](https://www.bghm.de/arbeitsschuetzer/themen/maschinen/faqs-cyber-resilience-act) has a machine-specific FAQ. Member States should, where appropriate, set up help channels for micro and small enterprises ([Article 33](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F33)). Applies to: New machines · Machines already sold ## How we check these answers Every answer rests on the official texts: the Cyber Resilience Act on EUR-Lex, the Commission's CRA FAQ and its guidance C(2026) 5252, the ENISA reporting platform FAQ, the Machinery Regulation and the Blue Guide. Each claim links to its source. A second review checked every article number, date and quote before publication. The questions come from what machine builders and importers ask at trade fairs, in tenders and in industry forums. Where the law leaves room for reading, the answer says so. ### What changed - 27 October 2026 First publication: 90 questions, checked against the official texts and reviewed by a second pass. **Aldo Campi**Co-founder and CEO, Edge SDN[LinkedIn](https://www.linkedin.com/in/aldo-campi/) ## Get help with the after-sale duties [Shield Lifecycle](https://www.edge-sdn.com/products/shield-lifecycle/) keeps the SBOM and attack surface of every machine you delivered, checks new CVEs every day, judges which machines are exposed and drafts the customer notice. [Edge Shield](https://www.edge-sdn.com/products/edge-shield/) isolates machines you cannot patch. You sign the declaration of conformity, we prepare the evidence. ## Where are you against 20 January 2027? Seven questions about how you work today. Three minutes. You get a score out of 10 and what is missing for you.