The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, entered into force on 10 December 2024. Its reporting obligations have applied since 11 September 2026, and the main obligations apply from 11 December 2027 (European Commission). For machine builders, the CRA is not only about the PLC or router you buy in. If you place your own products with digital elements on the EU market, such as a connected controller, an HMI application or a remote service gateway, you are the manufacturer and the duties are yours.
Below we summarise what the regulation asks for, where it touches a typical machine builder, and a realistic plan for the next 14 months.
The CRA timeline that matters to machine builders
| Date | What applies | Source |
|---|---|---|
| 10 Dec 2024 | Regulation in force | European Commission |
| 11 Jun 2026 | Rules on notified bodies (Chapter IV) | Regulation, Art. 71 |
| 11 Sep 2026 | Reporting of actively exploited vulnerabilities and severe incidents | Regulation, Art. 14 |
| 11 Dec 2027 | All other obligations, including essential requirements | Regulation, Art. 71 |
The reporting date has already passed. In Germany, reports go through ENISA's Single Reporting Platform, with CERT-Bund at the BSI as the coordinating CSIRT (BSI, 11 September 2026). The BSI notes that no prior registration on the platform is needed. The BSI has also been designated as Germany's market surveillance authority for the CRA, with powers to fine and to withdraw products (BSI, 7 October 2025).
What the Cyber Resilience Act requires of manufacturers
The essential requirements sit in Annex I of the regulation on EUR-Lex. Part I covers the product: it must be placed on the market without known exploitable vulnerabilities, ship with a secure-by-default configuration, and allow vulnerabilities to be fixed through security updates. Part II covers the process: vulnerability handling, including a software bill of materials (SBOM) in a commonly used, machine-readable format covering at least the top-level dependencies.
- Support period. At least five years, unless the product is expected to be in use for less time (Art. 13). For industrial machines that run 15 or 20 years, expect customers to ask for more.
- Reporting. An early warning of an actively exploited vulnerability or severe incident within 24 hours (Art. 14).
- Fines. Up to €15 million or 2.5% of worldwide annual turnover for breaches of the essential requirements (Art. 64).
- Classes. Annex III lists important products. Class I includes items such as routers, switches, VPN products and network management systems. Class II includes firewalls and intrusion detection systems. These classes face stricter conformity assessment.
Where the CRA touches a typical machine
Think of a packaging machine with a Siemens S7-1500, a Comfort Panel, a managed switch and a remote service router. The PLC, panel, switch and router are products with digital elements made by their suppliers, who carry CRA duties for them. Your own contribution is the application software, the configuration and possibly a service gateway or app you developed. Whether the machine as a whole, or your software, falls within scope as a product in its own right is a question to settle with your legal adviser using the Commission's guidance, published on 27 July 2026 (European Commission).
Even where your machine is not itself in scope, customers will push CRA expectations down the supply chain. Expect purchase specifications to ask for an SBOM, a vulnerability contact, a defined support period and a secure default configuration.
Questions to send your component suppliers now
- What support period do you commit to for this controller, HMI, switch or router, and from which date?
- Where do you publish security advisories, and how do we subscribe?
- Can you supply an SBOM for the firmware, and in which format?
- What is the secure default configuration, and which services must we disable ourselves?
- How are firmware updates signed and distributed?
The answers shape your own support promise. If a router in your standard machine design has a shorter support period than you intend to offer, that router is a design risk, not just a purchasing detail.
The overlap with the Machinery Regulation
The Machinery Regulation applies from 20 January 2027 and asks you to protect safety-relevant software against corruption and to withstand foreseeable malicious attempts. The CRA follows on 11 December 2027 and asks you to manage vulnerabilities across a support period. One security architecture should serve both. We cover the machinery side in EU Machinery Regulation 2027 and control software.
EU regulatory framework: CRA and OSS
Siemens Knowledge Hub
This video is hosted on YouTube. Playing it loads content from Google, which may set cookies.
Watch on YouTubeA 14-month plan for machine builders
- Now: name an owner for product security, set up a vulnerability contact address, and agree how you would file an early warning within 24 hours.
- By Q1 2027: build an inventory of the digital components in each machine type: controller firmware versions, HMI runtime, switches, routers, libraries and open-source packages.
- By Q2 2027: produce SBOMs for your own software and collect supplier SBOMs and support periods for bought-in components.
- By Q3 2027: harden default configurations: no default passwords, unused services off, remote access off until enabled by the customer.
- By Q4 2027: document your update process, the support period you commit to, and the security information you hand to customers.
How Wartens supports
Wartens helps machine builders with the engineering parts of the job: machine cybersecurity risk assessment, secure configuration of the control system, documentation and update processes, working alongside your CE partner and legal advisers. We deliver this as part of our automation engineering services for German clients.
Next step: send us the bill of materials for one machine type and we will return a first inventory of its digital components and the CRA questions it raises. Contact us.
