“I build machines, not software”
It is the sentence we hear most from machine builders when the Cyber Resilience Act comes up. It is a fair point. The company writes PLC logic, not apps. It has done CE marking for twenty years.
The law does not look at the company. It looks at the machine, and it looks at it twice.
Regulation (EU) 2023/1230The Machinery Regulation protects the peoplearoundthe machineRegulation (EU) 2024/2847The Cyber Resilience Act protects the softwareinsidethe machine
Why the CRA covers a machine
The CRA does not have a list of product types. It has one test, in Article 2(1).
This Regulation applies to products with digital elements made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network.
A machine passes that test as soon as it has one of these.
- A PLC or an HMISoftware you wrote or software you bought. Both count.
- An Ethernet portTo the MES, to telemetry, to the plant network.
- A service portUSB or a socket for the service laptop. A physical data connection.
- Remote maintenanceA VPN gateway or a cellular modem. An indirect connection.
Article 2 then lists what the CRA leaves to other laws: medical devices, in vitro diagnostics, type-approved motor vehicles, certified civil aviation products and marine equipment. Machinery is not on the list. Recital 53 names machine builders directly, and tells them what to do with the overlap.
Such synergies have to be demonstrated by the manufacturer, for instance by applying, where available, harmonised standards or other technical specifications covering relevant essential cybersecurity requirements following a risk assessment covering those cybersecurity risks. The manufacturer should also follow the applicable conformity assessment procedures set out in this Regulation and in Regulation (EU) 2023/1230.
Two words matter in that sentence: both procedures, demonstrated by the manufacturer. Meeting the CRA may help with points 1.1.9 and 1.2.1 of the Machinery Regulation. Nobody presumes it for you.
What each law asks of the same machine
The two regulations overlap on one idea, protection against malicious interference with software, and then go in different directions. The Machinery Regulation stops where safety stops. The CRA keeps going for the whole support period of the product.
| Duty | Machinery Regulation | Cyber Resilience Act |
|---|---|---|
| Risk assessment covers reasonably foreseeable malicious attempts by third parties | Required, Annex III 1.2.1 | Required, Annex I Part I |
| The machine identifies the installed safety software and gives the list on request | Required, Annex III 1.1.9 | In part: an SBOM in the technical documentation, Annex I Part II |
| Log of safety software versions and interventions, kept five years | Required, Annex III 1.2.1 | Not in these words |
| Software bill of materials for all components, not only safety | Not required | Required, Annex I Part II |
| Vulnerability handling for the support period, at least five years | Not required | Required, Article 13 and Annex I Part II |
| Early warning of an actively exploited vulnerability within 24 hours | Not required | Required, Article 14, since 11 September 2026 |
| Security updates provided to users, free of charge | Not required | Required, Annex I Part II |
| Written into one EU declaration of conformity | Yes, Article 21(3) | Yes, through the same declaration |
Read the right-hand column again. Four of eight rows are duties that did not exist in machine building before. They do not come from the Machinery Regulation. They come from the CRA, and they run for years after delivery.
Five cases from the stand
The same two laws, applied to the way machine builders actually sell.
| Your case | Machinery Regulation | Cyber Resilience Act | What it means for you |
|---|---|---|---|
| You build a complete machine and write its control software | Applies in full | Applies in full. You are the manufacturer of a product with digital elements | Two sets of requirements, one risk assessment with two chapters, one declaration |
| You build a complete machine with a bought PLC and HMI, no own software | Applies in full | Applies in full. The PLC vendor answers for the PLC, you answer for the machine | Due diligence on the components you integrate, Article 13. The vulnerability handling for the machine stays yours |
| You retrofit or revamp a machine already in the field, yours or someone else’s | A substantial modification makes you the manufacturer, Article 18 | A substantial modification after 11 December 2027 brings the machine into the CRA, Article 69(2) | The whole machine becomes your product. Decide before the job whether the change is substantial |
| You make partly completed machinery or a component sold separately | Declaration of incorporation, Article 22 | Your component is a product with digital elements on its own, Article 3(1) | Your customer’s machine inherits your SBOM and your vulnerability handling. They will ask for both |
| You sell industrial software on its own | Applies only when the software performs a safety function | Applies in full | The CRA is your main law. The reporting duty is already live |
Two sets of dates, one machine
A machine you ship in March 2027 falls under the Machinery Regulation and under the CRA reporting duty, but not yet under the CRA product requirements. A machine you ship in January 2028 falls under all three. Plan the technical file for the second case now. The components will not change in between.
Run both procedures without doing the work twice
Recital 53 asks for both procedures. It does not ask for two of everything. Most of the work serves both laws when it is organised once.
- One risk assessment, two chaptersKeep the safety assessment of ISO 12100. Add a security chapter that lists the ways software and data can be corrupted, who can connect in each operating state and what happens then. Point 1.2.1 and Annex I Part I read the same chapter.
- One component listThe SBOM the CRA asks for in the technical documentation is a superset of the safety software list of point 1.1.9. Mark the safety-relevant entries. Two duties, one list.
- One description of the attack surfaceWhich ports, protocols and interfaces are open in production, in local maintenance, in remote maintenance. The Machinery Regulation reads it as who may connect. The CRA reads it as what a vulnerability can reach.
- One monitoring processEach new vulnerability on a listed component is checked against the attack surface. Exposed or not. If exposed, the safety risk assessment gets a new look. This is the part that never ends, and it feeds both files.
- One declarationArticle 21(3) of the Machinery Regulation: one EU declaration of conformity names both regulations with their publication references. One signature.
Where machinery or a related product is subject to more than one Union legal act that requires an EU declaration of conformity, a single EU declaration of conformity shall be drawn up in respect of all such acts.
Where the presumption of conformity stands
The Machinery Regulation offers one shortcut for the cybersecurity points. Article 20(9): a machine certified under an EU cybersecurity certification scheme adopted under Regulation (EU) 2019/881 is presumed to meet points 1.1.9 and 1.2.1, as far as the certificate covers them. Today no machine builder we know holds such a certificate for a machine. The harmonised standards for these two points are not yet cited in the Official Journal either, and the CRA standards are still being written.
What Shield Lifecycle does here, and what it does not
Shield Lifecycle keeps steps 2, 3 and 4 running after delivery: the SBOM per delivered machine, the attack surface per operating state, the daily check of new vulnerabilities against it, the VEX record, the drafted notices for the CSIRT and for your customer, and the evidence that the process ran. Edge Shield closes the paths into the machine that the attack surface says should be closed, without touching the PLC program.
If you build machines and you were waiting for someone to tell you the CRA is not your law, this article is the opposite of that. It is your law, next to the one you already know, and most of the work serves both.