Machinery Regulation and Cyber Resilience Act: who does what

When a machine falls under both regulations

The Machinery Regulation (opens in a new tab) applies from 20 January 2027 (Article 54, as corrected in Official Journal L 169 of 4 July 2023). The Cyber Resilience Act (CRA) covers products with digital elements whose intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network (Article 2(1) CRA (opens in a new tab)). It applies from 11 December 2027; its reporting duties have applied since 11 September 2026 (Article 71(2)).

A machine with a fieldbus, Ethernet or wireless interface is usually both, like the food packing machine in the Commission services' FAQs on the CRA (opens in a new tab) (section 2.4.1).

Neither regulation presumes conformity with the other. Meeting the CRA could facilitate compliance with sections 1.1.9 (protection against corruption) and 1.2.1 (safety and reliability of control systems) of Annex III to the Machinery Regulation, but you must demonstrate this and follow both conformity assessment procedures (Recital 53 CRA; FAQs, sections 2.4.2 and 2.4.3). Until 11 June 2028 at the latest, an EU type-examination certificate under the Machinery Regulation can serve the CRA for the cyber risks it covers (Article 69(1) CRA; Commission guidance C(2026) 5252 (opens in a new tab), points 255 and 256).

As of 5 October 2026, no harmonized standard giving a presumption of conformity had been cited under the Machinery Regulation (Article 20(1)).

What the Machinery Regulation and Cyber Resilience Act each require

The Machinery Regulation addresses cyber risks only insofar as they affect safety (Recital 25). Section 1.1.9 requires that connected devices and remote access cannot create a hazardous situation, that safety-critical software and data are protected against corruption, and that the machine identifies its safety software and records interventions. Section 1.2.1 requires control systems that withstand reasonably foreseeable malicious attempts, and a log of interventions and of safety software versions uploaded after placing on the market, enabled for five years.

The CRA looks at security itself: no known exploitable vulnerabilities, a secure default configuration, access control and protection of data and commands (Annex I, Part I). For a support period, you handle vulnerabilities, keep a software bill of materials and provide security updates, free of charge unless otherwise agreed for a tailor-made business product (Annex I, Part II).

The support period reflects the machine's expected use time, at least five years unless that is shorter (Article 13(8)). You state its end date at purchase (Article 13(19)).

Who answers for what: manufacturer, integrator, operator

When you integrate components, you exercise due diligence and report vulnerabilities you find to their makers (Article 13(5) and (6) CRA); if a component's support ends first, you still remedy them (FAQs, section 4.3.7).

You need not control the plant's network, but you mitigate its risks by design and inform users about deployment risks (CRA guidance, point 168). Plants have their own duties under directives as transposed nationally: employers maintain work equipment so it stays compliant (Article 4(2) of Directive 2009/104/EC (opens in a new tab)), and entities covered by the NIS2 Directive (EU) 2022/2555 (opens in a new tab) weigh suppliers' secure development procedures (Article 21(3)). Expect questions about your support period.

When a software update is a substantial modification

Under the Machinery Regulation, a physical or digital change after placing on the market or putting into service is a substantial modification only if the manufacturer did not foresee or plan it, it creates a new hazard or increases a risk, and it requires new guards or protective devices that need changes to the existing safety control system, or measures for stability or strength (Article 3(16)).

Under the CRA, a change is substantial if it affects compliance with Annex I, Part I, or modifies the intended purpose for which the product was assessed (Article 3(30)). Security updates that reduce risk without changing the intended purpose are not; feature updates that widen the attack surface can be (Recital 39).

Machines placed on the market before 11 December 2027 come under the CRA only if substantially modified from that date (Article 69(2)); for the original manufacturer, the guidance limits this to the modified parts unless the cybersecurity of the whole machine suffers (point 124).

An update process that works under both regulations

1. 1.Map every interface, fieldbus to cloud, and record whether the machine is a product with digital elements (Article 2(1) CRA).
2. 2.Run one threat analysis for both files: link each threat to Annex III, sections 1.1.9 and 1.2.1, and to the CRA risk assessment (Article 13(2) and (3)).
3. 3.Describe planned updates before launch, so they count as foreseen (Article 3(16); guidance, point 106), and assess every other release under both tests.
4. 4.Sign, check and log updates: integrity and secure distribution (Annex I, Part I, point 2(f), and Part II, point 7 CRA), safety software log for five years (Annex III, 1.2.1(f)).
5. 5.Let the plant decide when to install: automatic updates are not expected where they could interfere with industrial operations (Recital 56 CRA); explain installation (Annex II, point 8(c)).

Example: a Canadian maker of palletizing cells

A Canadian company sells palletizing cells to EU food plants, with safety laser scanners, a safety controller, remote service and its own cloud dashboard. Cells placed on the market from 11 December 2027 need one EU Declaration of Conformity covering both acts (Article 28(3) CRA).

In 2028, it adds a cloud function, not covered by its risk assessment, that restarts a cell after a fault. In Example 40 of the CRA guidance, a monitoring dashboard was substantially modified, as its intended purpose changed, when it gained functions to control machines, including by "restarting machines following fault conditions". On our reading, the same applies to the cell; as a machine must not start unexpectedly (Annex III, section 1.2.1), the company reassesses it under both tests.

If a plant later shrinks the scanners' protective fields to speed up the line, it can become manufacturer under Article 18 of the Machinery Regulation. Under the CRA, our reading is that it does not, as it keeps the cell instead of making it available on the market (Article 22(1)).

Common mistakes with connected machines

• Settling for five years of support. A machine expected to run longer needs a support period that reflects this (Article 13(8); guidance, point 126).
• Leaving safety settings to plant rules. Parameters must not change in an uncontrolled way, and no modifications are allowed to settings or rules generated by the machine or by operators, where this could be hazardous (Annex III, 1.2.1).
• Forgetting machines in the field. CRA reporting has applied to them since 11 September 2026 (Article 69(3)).
• Leaving integrators guessing. Supply the information of Annex II, point 8(f) CRA with your assembly instructions.

Conclusion: decide before delivery who answers for the code

Cybersecurity is cheapest while interfaces, update paths and safety settings are still drawings. Decide before the first unit ships who answers when an authority asks for the update log, or a customer asks how long you will patch. See also our Machinery Regulation checklist and, for radio equipment placed on the market until 10 December 2027, the cybersecurity requirements of the Radio Equipment Directive.

Design, risk assessment, vulnerability handling and the technical documentation stay with you as manufacturer; under Article 18(2) CRA, they cannot even be part of an authorized representative's mandate. Our CE marking service helps you, within the agreed scope, identify the applicable acts and harmonized standards, coordinate testing and review your technical documentation.

Frequently asked questions