Cyber Resilience Act: Reporting Obligations and Duties for Machine Builders

The Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) is the first EU-wide cybersecurity obligation for products. It does not only affect IT manufacturers: every machine with a controller and a network or data connection is a product with digital elements. This makes the machine builder a manufacturer within the meaning of the CRA, with its own obligations throughout the entire lifecycle. Some of them already apply.

Key dates

The reporting obligations already apply

Since 11 September 2026, manufacturers must report two types of events:

• Actively exploited vulnerabilities in their product, i.e. weaknesses that are demonstrably being attacked
• Severe incidents that affect the security of the product

Reports are submitted via a single reporting platform to the competent national CSIRT and to the EU agency ENISA. The deadlines are short:

1. Early warning within 24 hours of the manufacturer becoming aware
2. Notification within 72 hours with an initial assessment and mitigating measures
3. Final report: for vulnerabilities no later than 14 days after a fix is available, for incidents within one month

Affected users must also be informed, where necessary with advice on how to limit the impact. Important: the reporting obligation also applies to machines that were delivered before 2027 and are still on the market.

Anyone who has to report within 24 hours needs a fixed procedure: who receives reports, who assesses them, who submits the notification? This cannot be worked out only when an incident occurs.

What is added from December 2027

From 11 December 2027, a machine with digital elements may only be placed on the market if it meets the essential requirements in Annex I of the CRA. The most important points:

• Security by design: cybersecurity risk assessment during development, secure default settings on delivery, no known exploitable vulnerabilities
• Protection of access and data: authentication, protection against unauthorised access, integrity of programs and configuration, a minimal attack surface
• Vulnerability handling: a point of contact for reports, a coordinated disclosure process and a software bill of materials (SBOM) listing the components used
• Security updates: the manufacturer defines a support period, generally at least five years, and provides updates during this time
• Documentation: technical documentation and declaration of conformity, kept for ten years

For most machines, a conformity assessment by the manufacturer itself is sufficient. Stricter procedures apply to certain "important" and "critical" products listed in Annexes III and IV of the CRA. Whether a built-in device falls into these categories should be checked case by case.

Infringements of the essential requirements can be fined up to 15 million euros or 2.5 percent of worldwide annual turnover.

What this means for machine building

• Purchased components: Controllers, HMIs and drives are subject to the CRA at their own manufacturer. When integrating them, however, the machine builder must exercise due diligence to ensure that these components do not compromise the security of the machine.
• Your own software counts: PLC programs, HMI projects, remote maintenance solutions and in-house tools are part of the product. Vulnerability handling and update obligations apply to them as well.
• Follow vendor advisories: Security advisories from component manufacturers, such as Siemens ProductCERT, must be evaluated regularly and mapped to your own machines. Without an SBOM this is hardly possible.
• Get updates to the customer: Many machines run in production without internet access. A practical way is needed to install firmware and software updates securely without unnecessarily disrupting production.
• Interplay with the Machinery Regulation: Meeting the CRA requirements largely covers the tampering protection of the Machinery Regulation as well. Both should therefore be planned in a common concept, for example based on IEC 62443.

Checklist: act now

1. Set up a reporting process: define a point of contact for vulnerability reports and clarify responsibilities and deputies for the 24-hour deadline.
2. Take stock of products: Which machine types and software versions are on the market? Which components do they contain?
3. Build an SBOM: document hardware, firmware, libraries and in-house software for each machine type.
4. Monitor security advisories: subscribe to supplier advisories and define an assessment procedure.
5. Define support period and update path: How long will updates be provided and how do they reach the machine?
6. Adapt development: make security by design and secure default settings part of the machine standard.
7. Prepare documentation: align technical documentation and the declaration of conformity with the CRA and the Machinery Regulation.

Conclusion

The Cyber Resilience Act makes cybersecurity a manufacturer obligation, including in machine building. The reporting obligations already apply, and vulnerability handling, updates and documentation must be in place by December 2027. Tackling this together with the requirements of the new Machinery Regulation avoids duplicate work and gives you a clear standard for all machines.

Note: This article provides a technical overview and does not constitute legal advice. The authoritative source is the text of the regulation in the Official Journal of the EU.