--- title: "Does the CRA apply to machinery? Both laws, explained | Edge SDN" description: "A connected machine falls under the Cyber Resilience Act and the Machinery Regulation at once. What each law asks, which dates apply and how to do the work once." url: https://www.edge-sdn.com/use-cases/cra-or-machinery-regulation/ last_updated: 2026-10-09 --- CRA · Machinery Regulation · Machine builder · System integrator # Check which law covers your machine: the Cyber Resilience Act, the Machinery Regulation or both By Aldo Campi, co-founder and CEO of Stoorm5 · Published 9 October 2026 · Last updated 9 October 2026 Does the Cyber Resilience Act apply to machinery? Yes, in almost every case. A machine with software and any data connection is a product with digital elements under Regulation (EU) 2024/2847, and it stays a machine under Regulation (EU) 2023/1230. Both apply, with their own requirements and dates: Machinery Regulation from 20 January 2027, CRA reporting duty since 11 September 2026, CRA in full from 11 December 2027. Where are you against 20 January 2027? [Take the Check 2027](https://www.edge-sdn.com/check-2027/): seven questions, three minutes. ## Key facts - The CRA applies to every product with digital elements whose intended or foreseeable use includes a direct or indirect, logical or physical data connection to a device or network. A machine with a PLC, an HMI, an Ethernet port or a USB service port qualifies. [\[Regulation (EU) 2024/2847, Article 2(1)\]](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F2) - The CRA excludes medical devices, in vitro diagnostics, type-approved motor vehicles, certified civil aviation products and marine equipment. Machinery is not on the list. Recital 53 names machine builders and asks them to follow both conformity procedures. [\[Regulation (EU) 2024/2847, Article 2(2) to (4) and Recital 53\]](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F2) - Machines placed on the market before 11 December 2027 meet the CRA product requirements only if they are substantially modified after that date. The Article 14 reporting duty applies to all of them anyway. [\[Regulation (EU) 2024/2847, Article 69(2) and (3)\]](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F69) - A machine certified under an EU cybersecurity certification scheme is presumed to meet Annex III points 1.1.9 and 1.2.1 of the Machinery Regulation, as far as the certificate covers them. No other shortcut exists in the text. [\[Regulation (EU) 2023/1230, Article 20(9)\]](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R1230#art%5F20) - A machine covered by more than one EU act that requires an EU declaration of conformity gets one single declaration that names all of them. [\[Regulation (EU) 2023/1230, Article 21(3)\]](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R1230#art%5F21) ## “I build machines, not software” It is the sentence we hear most from machine builders when the Cyber Resilience Act comes up. It is a fair point. The company writes PLC logic, not apps. It has done CE marking for twenty years. The law does not look at the company. It looks at the machine, and it looks at it twice. ## Regulation (EU) 2023/1230The Machinery Regulation protects the peoplearoundthe machineRegulation (EU) 2024/2847The Cyber Resilience Act protects the softwareinsidethe machine ## Why the CRA covers a machine The CRA does not have a list of product types. It has one test, in Article 2(1). [Regulation (EU) 2024/2847, Article 2(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F2) A machine passes that test as soon as it has one of these. - **A PLC or an HMI**Software you wrote or software you bought. Both count. - **An Ethernet port**To the MES, to telemetry, to the plant network. - **A service port**USB or a socket for the service laptop. A physical data connection. - **Remote maintenance**A VPN gateway or a cellular modem. An indirect connection. Article 2 then lists what the CRA leaves to other laws: medical devices, in vitro diagnostics, type-approved motor vehicles, certified civil aviation products and marine equipment. Machinery is not on the list. Recital 53 names machine builders directly, and tells them what to do with the overlap. [Regulation (EU) 2024/2847, Recital 53](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#rct%5F53) Two words matter in that sentence: **both** procedures, **demonstrated** by the manufacturer. Meeting the CRA may help with points 1.1.9 and 1.2.1 of the Machinery Regulation. Nobody presumes it for you. ## What each law asks of the same machine The two regulations overlap on one idea, protection against malicious interference with software, and then go in different directions. The Machinery Regulation stops where safety stops. The CRA keeps going for the whole support period of the product. | Duty | Machinery Regulation | Cyber Resilience Act | | ---------------------------------------------------------------------------------- | ----------------------------- | ---------------------------------------------------------------- | | Risk assessment covers reasonably foreseeable malicious attempts by third parties | **Required**, Annex III 1.2.1 | **Required**, Annex I Part I | | The machine identifies the installed safety software and gives the list on request | **Required**, Annex III 1.1.9 | In part: an SBOM in the technical documentation, Annex I Part II | | Log of safety software versions and interventions, kept five years | **Required**, Annex III 1.2.1 | Not in these words | | Software bill of materials for all components, not only safety | Not required | **Required**, Annex I Part II | | Vulnerability handling for the support period, at least five years | Not required | **Required**, Article 13 and Annex I Part II | | Early warning of an actively exploited vulnerability within 24 hours | Not required | **Required**, Article 14, since 11 September 2026 | | Security updates provided to users, free of charge | Not required | **Required**, Annex I Part II | | Written into one EU declaration of conformity | **Yes**, Article 21(3) | **Yes**, through the same declaration | Read the right-hand column again. Four of eight rows are duties that did not exist in machine building before. They do not come from the Machinery Regulation. They come from the CRA, and they run for years after delivery. ## Five cases from the stand The same two laws, applied to the way machine builders actually sell. | Your case | Machinery Regulation | Cyber Resilience Act | What it means for you | | ------------------------------------------------------------------------------ | ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------ | | You build a complete machine and write its control software | Applies in full | Applies in full. You are the manufacturer of a product with digital elements | Two sets of requirements, one risk assessment with two chapters, one declaration | | You build a complete machine with a bought PLC and HMI, no own software | Applies in full | Applies in full. The PLC vendor answers for the PLC, you answer for the machine | Due diligence on the components you integrate, Article 13. The vulnerability handling for the machine stays yours | | You retrofit or revamp a machine already in the field, yours or someone else’s | A substantial modification makes you the manufacturer, Article 18 | A substantial modification after 11 December 2027 brings the machine into the CRA, Article 69(2) | The whole machine becomes your product. Decide before the job whether the change is substantial | | You make partly completed machinery or a component sold separately | Declaration of incorporation, Article 22 | Your component is a product with digital elements on its own, Article 3(1) | Your customer’s machine inherits your SBOM and your vulnerability handling. They will ask for both | | You sell industrial software on its own | Applies only when the software performs a safety function | Applies in full | The CRA is your main law. The reporting duty is already live | **Machines already in the field** The CRA product requirements apply to products placed on the market from 11 December 2027, or to older ones only after a substantial modification, Article 69(2). The Article 14 reporting duty is different: since 11 September 2026 it applies to every product with digital elements on the market, including machines you delivered years ago, Article 69(3). ## Two sets of dates, one machine CRA reporting duty. Early warning of an actively exploited vulnerability within 24 hours[Regulation (EU) 2024/2847, Article 14 and 71](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F71) Machinery Regulation applies. Cybersecurity enters the CE marking of new machines[Regulation (EU) 2023/1230, corrigendum](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R1230R%2801%29) CRA applies in full. SBOM, vulnerability handling and updates for new products[Regulation (EU) 2024/2847, Article 71](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art%5F71) A machine you ship in March 2027 falls under the Machinery Regulation and under the CRA reporting duty, but not yet under the CRA product requirements. A machine you ship in January 2028 falls under all three. Plan the technical file for the second case now. The components will not change in between. ## Run both procedures without doing the work twice Recital 53 asks for both procedures. It does not ask for two of everything. Most of the work serves both laws when it is organised once. 1. **One risk assessment, two chapters**Keep the safety assessment of ISO 12100. Add a security chapter that lists the ways software and data can be corrupted, who can connect in each operating state and what happens then. Point 1.2.1 and Annex I Part I read the same chapter. 2. **One component list**The SBOM the CRA asks for in the technical documentation is a superset of the safety software list of point 1.1.9. Mark the safety-relevant entries. Two duties, one list. 3. **One description of the attack surface**Which ports, protocols and interfaces are open in production, in local maintenance, in remote maintenance. The Machinery Regulation reads it as who may connect. The CRA reads it as what a vulnerability can reach. 4. **One monitoring process**Each new vulnerability on a listed component is checked against the attack surface. Exposed or not. If exposed, the safety risk assessment gets a new look. This is the part that never ends, and it feeds both files. 5. **One declaration**Article 21(3) of the Machinery Regulation: one EU declaration of conformity names both regulations with their publication references. One signature. [Regulation (EU) 2023/1230, Article 21(3)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R1230#art%5F21) ## Where the presumption of conformity stands The Machinery Regulation offers one shortcut for the cybersecurity points. Article 20(9): a machine certified under an EU cybersecurity certification scheme adopted under Regulation (EU) 2019/881 is presumed to meet points 1.1.9 and 1.2.1, as far as the certificate covers them. Today no machine builder we know holds such a certificate for a machine. The harmonised standards for these two points are not yet cited in the Official Journal either, and the CRA standards are still being written. **What this means in practice** Until the standards arrive, nobody can hand you a presumption of conformity for the cybersecurity of a machine. You do the risk assessment, you build the evidence, you sign. The regulations say what the machine must do. The evidence that it does it is yours to keep, for years. ## What Shield Lifecycle does here, and what it does not [Shield Lifecycle](https://www.edge-sdn.com/products/shield-lifecycle/) keeps steps 2, 3 and 4 running after delivery: the SBOM per delivered machine, the attack surface per operating state, the daily check of new vulnerabilities against it, the VEX record, the drafted notices for the CSIRT and for your customer, and the evidence that the process ran. [Edge Shield](https://www.edge-sdn.com/products/edge-shield/) closes the paths into the machine that the attack surface says should be closed, without touching the PLC program. **What we do not do** We do not do your safety risk assessment, we do not write your declaration of conformity and we do not certify anything. No tool can make a machine compliant with either regulation. The manufacturer signs. We give you the daily monitoring and the evidence behind the signature. If you build machines and you were waiting for someone to tell you the CRA is not your law, this article is the opposite of that. It is your law, next to the one you already know, and most of the work serves both. ## Frequently asked questions ### I buy the PLC and the HMI. Is the CRA the component vendor's problem or mine? Both. The PLC vendor is the manufacturer of the PLC, a product with digital elements placed on the market separately. You are the manufacturer of the machine, which is also a product with digital elements. Article 13 asks you to exercise due diligence on the components you integrate, and the vulnerability handling for the machine as a whole stays with you. ### My machine has no network connection. Does the CRA still apply? Read Article 2(1) carefully: direct or indirect, logical or physical. A USB service port, a slot for a service laptop or a cellular modem for telemetry is a data connection. A machine with no port of any kind is rare. If you believe yours is one, record the reasoning in the technical file. ### Do I need a notified body for the CRA? For most machines, no. The default category of the CRA is self-assessment by internal control. A notified body enters when the product itself is an important or critical product listed in Annex III or IV, for example certain firewalls, routers or microcontrollers with security functions. Check the component you sell as a product, not only the machine. ### Two regulations, two declarations? No. Article 21(3) of the Machinery Regulation says one single EU declaration of conformity is drawn up for all the EU acts that require one, each identified by its publication reference. One document, two regulations, one signature. ### Which law applies to a machine I deliver in March 2027? The Machinery Regulation, because it is placed on the market after 20 January 2027. The CRA product requirements apply to products placed on the market from 11 December 2027, so not yet to that machine, unless you substantially modify it later. The CRA reporting duty of Article 14 applies to it from day one. Product ### Shield Lifecycle [Explore Shield Lifecycle](https://www.edge-sdn.com/products/shield-lifecycle/) Product ### Edge Shield [Explore Edge Shield](https://www.edge-sdn.com/products/edge-shield/) Related use case ### Same model, two machines, one exposed: find which shipped machines a new CVE hits [Read](https://www.edge-sdn.com/use-cases/find-which-machines-a-new-cve-exposes/) Related use case ### Prepare for point 1.1.9: what your machine must know about its own software from 20 January 2027 [Read](https://www.edge-sdn.com/use-cases/machinery-regulation-point-1-1-9/) Related use case ### Report to ENISA in 24 hours: what a machine builder must do since 11 September 2026 [Read](https://www.edge-sdn.com/use-cases/report-to-enisa-in-24-hours/) This article is a summary for practitioners and not legal advice. Always check the official text for your case. ## Where are you against 20 January 2027? Seven questions about how you work today. Three minutes. You get a score out of 10 and what is missing for you.