CRA for Machinery: Which Connected Products Count?

Written by the NIS2Compass editorial team | As of: October 2026

In machinery manufacturing, the Cyber Resilience Act covers every product with a data connection you place on the market: connected controllers, HMIs, edge gateways and machine software. Purely mechanical parts without an interface don't count. The manufacturer is responsible and, since 11 September 2026, also subject to reporting obligations. For your own operations' NIS2 obligations, NIS2Compass offers 45+ templates.

Which Connected Products in Machinery Manufacturing Fall Under the CRA?

The CRA covers every hardware or software product intended to exchange data directly or indirectly with a device or network. In machinery manufacturing: connected controllers, HMIs, edge gateways, machine software and the connected machine as a whole. Mechanical components without a data connection are excluded.

• Covered, for example: PLCs (programmable logic controllers) with an Ethernet or fieldbus interface, HMI panels, edge gateways, remote maintenance routers and frequency converters with a network interface. So are machine software and firmware, even when placed on the market separately as components (Art. 2(1), Art. 3(1) CRA).
• The machine as a whole counts as well: A machine with a data connection, for instance to the MES or for remote maintenance, is itself a product with digital elements. The Commission guidance treats both a complex industrial machine with cloud backend and an industrial automation system as single CRA products. This is the Commission's interpretation, not binding law.
• Remote data processing is included: A manufacturer-developed cloud backend without which the machine loses a function is part of the product. The CRA calls this a remote data processing solution (Art. 3(1) and (2)).
• An indirect connection is enough: Under the wording of Art. 3(10), a sensor without its own network address that is attached via fieldbus to a networked PLC is indirectly connected through the larger system. No authority has confirmed this yet.
• Not covered: purely mechanical or electromechanical components without digital elements, such as gearboxes, bearings or pneumatic cylinders without electronics. Identical spare parts are exempt (Art. 2(6)): per the Commission guidance (interpretation), this covers an identical replacement PLC, not a replacement chip with a different cryptographic implementation. Products under sector-specific law, such as medical devices, are also excluded (Art. 2(2) to (4)).
• Your role matters, not your sector: The obligations apply to whoever manufactures a product, or has it manufactured, and markets it under their own name (Art. 3(13)). A machinery company that only operates machines is not a CRA manufacturer here. The NIS2Compass CRA Applicability Check clarifies whether you are a manufacturer, importer or distributor.

According to Bitkom, 67% of companies in Germany are aware of the CRA, but only 29% know what it means for their own business. The survey covered 1,003 companies with 10+ employees, not manufacturers specifically.

When Is an Industrial Component an Important or Critical Product Under the CRA?

A product is only important or critical if its core functionality matches an Annex III or IV category. For machinery manufacturers, this mainly concerns routers, switches, VPN gateways, network interfaces, operating systems and firewalls sold as standalone products. PLCs and HMIs are not separate categories there.

Annex III of the Cyber Resilience Act lists 23 categories of important products, 19 in Class I and 4 in Class II. Annex IV lists 3 categories of critical products. They are described technically in Implementing Regulation (EU) 2025/2392. Typical examples in machinery manufacturing:

• Products with VPN functionality (Class I No. 5): such as remote maintenance gateways built around a VPN tunnel.
• Physical and virtual network interfaces (No. 10): per the Implementing Regulation, explicitly including fieldbus controllers and adapters.
• Operating systems (No. 11): including standalone real-time operating systems.
• Routers, modems intended for connection to the internet, and switches (No. 12): including managed switches.
• Microcontrollers with security-related functionalities (No. 14): relevant if you supply your own control electronics.
• Firewalls (Class II No. 2): such as industrial firewalls. Third-party conformity assessment is mandatory here (Art. 32(3)).

In Class I, self-assessment under Module A is only sufficient if harmonised standards, common specifications or a certification scheme are applied in full (Art. 32(2)). According to the BSI page on the Cyber Resilience Act, these standards are still in development. Annex IV rarely concerns machinery. Smart meter gateways are critical products under Annex IV No. 2.

The Commission guidance is interpretation, not binding law. It treats technical capabilities as decisive, not marketing. An edge gateway is a borderline case: if it mainly collects machine data, its core functionality differs from a router's. If its core functionality is routing or the VPN tunnel, Class I is likely.

Does a Built-In Router Make the Whole Machine an Important Product?

No. Under the second sentence of Art. 7(1) CRA, integrating an important product does not make the overall product important. The Commission's guidance applies the same logic to critical products (para. 141, interpretation). Still, due diligence under Art. 13(5) applies to purchased components, and you assess the machine's security as a whole (Implementing Regulation 2025/2392, Recital 3).

What Does the CRA Change in Practice for a Mid-Sized Machinery Manufacturer?

A machinery manufacturer that sells connected machines under its own name is a CRA manufacturer and has been reporting actively exploited vulnerabilities since 11 September 2026. From 11 December 2027, every connected machine newly placed on the market needs a CRA conformity assessment. If it also sells its own VPN gateway, the stricter procedure for important products applies there.

Take a packaging machinery manufacturer with 140 employees selling under its own brand in the EU. Each machine contains a purchased PLC, an HMI panel, in-house machine software and a self-developed remote maintenance gateway that is also sold separately. Under NIS2, it is an important entity (Annex 2 No. 5.4, § 28(2) BSIG).

Until now, cybersecurity was mainly a matter for customer contracts, and product law meant the Machinery Directive 2006/42/EC. Since 11 September 2026, it reports actively exploited vulnerabilities under Art. 14 CRA, including for machines already delivered (Art. 69(3)). For the process, see CRA reporting: Art. 14 vs. § 32 BSIG. From 11 December 2027, Annex I with a software bill of materials (SBOM), conformity assessment and CE marking follow; for existing machines, only after a substantial modification (Art. 69(2)).

The classification per product:

• Machine with PLC and HMI: default category, self-assessment under Module A (Art. 32(1)). The integrated component does not make the machine important (second sentence of Art. 7(1)), but the PLC is still part of the assessment (Art. 13(5)).
• Remote maintenance gateway with VPN as core functionality: important product under Annex III Class I No. 5. Module A only with fully applied harmonised standards, otherwise Module B + C or H (Art. 32(2)).
• Purchased PLC: The PLC manufacturer bears the manufacturer obligations. The machinery manufacturer requests proof of conformity and update commitments.

The support period is generally at least five years and reflects the expected period of use (Art. 13(8) CRA). Machines often run much longer, and the end date must be stated at purchase, at least as month and year (Art. 13(19)). The PLC manufacturer's update commitment must therefore match your own.

From 11 December 2027, infringements of Art. 13 and 14 carry fines of up to €15 million or 2.5% of total worldwide annual turnover (Art. 64(2) CRA).

Start with a product list per machine type: component, manufacturer, software version, SBOM per software release, CRA category and committed support period.

Does the Machinery Regulation Replace the CRA?

No. Manufacturers of connected machines must comply with both regulations from 2027: the Machinery Regulation (EU) 2023/1230 from 20 January 2027 and the CRA's cybersecurity requirements from 11 December 2027. The Machinery Regulation protects against hazards from tampering, the CRA governs cybersecurity across the lifecycle.

The dates are almost eleven months apart. The Machinery Regulation date follows from the corrigendum in OJ L 169 of 4 July 2023. According to Recital 53 of the Cyber Resilience Act, manufacturers of such machinery "should comply with both the essential cybersecurity requirements set out in this Regulation and the essential health and safety requirements set out in Regulation (EU) 2023/1230".

The Machinery Regulation contains two cyber-related requirements in Annex III:

• 1.1.9 Protection against corruption: Connected devices must not create a hazardous situation. Safety-relevant software and data must be protected and interventions logged.
• 1.2.1 Safety and reliability of control systems: Control systems must withstand reasonably foreseeable malicious attempts by third parties that lead to hazardous situations.

The difference lies in the protection goal: the Machinery Regulation protects people (safety), the CRA protects the product itself (security), including vulnerability handling throughout the support period (Annex I Part II CRA).

Neither regulation creates a mutual presumption of conformity. According to Recital 53, the CRA "could facilitate" compliance with 1.1.9 and 1.2.1. Both conformity assessments remain mandatory.

The only bridge is the Cybersecurity Act: machinery with a certificate or declaration of conformity under a scheme of Regulation (EU) 2019/881 published in the Official Journal is presumed to comply with 1.1.9 and 1.2.1, as far as the evidence covers them (Art. 20(9) Machinery Regulation). You draw up a single EU declaration of conformity for both legal acts (Art. 28(3) CRA, Art. 21(3) Machinery Regulation).

Existing certificates get a transition. In the Commission's interpretation (guidance paras. 255–257, not binding), an EU type-examination certificate under the Machinery Regulation also counts under the CRA for the risks from 1.1.9 and 1.2.1, until 11 June 2028 at the latest (Art. 69(1) CRA). It does not cover other CRA risks.

Set up a joint safety and security risk assessment per machine type and combine the evidence for both regulations in one declaration of conformity.

Which CRA Obligations Have Applied Since 11 September 2026, and Which Come Later?

Since 11 September 2026, only the reporting obligation under Art. 14 CRA applies to manufacturers. The Machinery Regulation applies from 20 January 2027, and all other CRA obligations, including fines, from 11 December 2027. As a machinery manufacturer with 50 or more employees, or annual turnover and balance sheet total each above €10 million, your own operations have separately been subject to NIS2 since 6 December 2025.

• Since 6 December 2025, NIS2: manufacturers above the size threshold are important entities (Annex 2 No. 5.4 BSIG), with obligations under § 30 BSIG and § 32 BSIG.
• Since 11 June 2026, CRA Chapter IV: notification of conformity assessment bodies, no manufacturer obligation.
• Since 11 September 2026, CRA Art. 14: manufacturers report actively exploited vulnerabilities and severe incidents, early warning within 24 hours (Art. 14(2)(a) and (4)(a) CRA). This also applies to products already on the market (Art. 69(3)).
• From 20 January 2027, Machinery Regulation: applies to machinery newly placed on the market (Art. 54(2), corrected version).
• From 11 December 2027, CRA in full: Annex I, conformity assessment, CE marking, importers and distributors (Art. 19 to 22), fines under Art. 64, as set out in Art. 71(2) CRA.

NIS2 covers your own IT and production; the CRA and Machinery Regulation cover the machines you sell. Reporting used to concern operations only; since 11 September 2026, products have their own reporting obligation. See CRA and NIS2 compared and NIS2 incident reporting.

For the NIS2 side, the NIS2Compass template catalogue includes templates on incident management and management body training, among others.

What Does the CRA Mean for Municipal Utilities Using Smart Meter Gateways?

Smart meter gateways are critical products under Annex IV No. 2 CRA, but the obligations fall on their manufacturer. A municipal utility that buys and deploys gateways as metering point operator is not a CRA manufacturer. There, the CRA works through procurement: proof of conformity, a committed support period and manufacturer notifications about vulnerabilities.

Annex IV CRA has only three categories of critical products. No. 2 lists "Smart meter gateways within smart metering systems as defined in Article 2, point (23) of Directive (EU) 2019/944 of the European Parliament and of the Council and other devices for advanced security purposes, including for secure cryptoprocessing". According to Implementing Regulation (EU) 2025/2392, they control communication with authorised third parties such as suppliers, encrypt metering data and include firewall functions. Gas or heat gateways may also qualify.

Conformity assessment is up to the manufacturer. A European cybersecurity certification is only mandatory if the Commission requires it by delegated act under Art. 8(1). Until then, procedures involving third parties apply (Art. 32(3) and (4)).

In Germany, a gateway already generally needs a BSI certificate under Common Criteria or EUCC (§ 24(1) MsbG); without a valid certificate, it cannot be used in a smart metering system (para. 4). Whether it counts towards CRA conformity is open.

The municipal utility is a NIS2 entity in the energy sector (Annex 1 BSIG). For network and plant operations, §§ 5c to 5e EnWG apply instead of §§ 30 and 32 BSIG (§ 28(5) BSIG). § 5c EnWG requires appropriate protection from procurement onwards. This is where the CRA comes in; more for municipal utilities and energy suppliers.

What the CRA gives procurement:

• End date of the support period: at least month and year at the time of purchase (Art. 13(19)), for products from 11 December 2027.
• Notifications about actively exploited vulnerabilities: since 11 September 2026 (Art. 14(8)), including for devices already in use (Art. 69(3)).
• CE marking and EU declaration of conformity: with reference to the CRA for gateways from 11 December 2027.

A municipal utility only becomes a CRA manufacturer if it markets a product with digital elements under its own name (Art. 3(13)), such as a customer app. The CRA Applicability Check clarifies this.

Add three points to current tenders and framework agreements for gateways and control systems: a support period with an end date, a notification channel for vulnerability notices and, from 11 December 2027, proof of CRA conformity alongside the BSI certificate under the MsbG.

Frequently Asked Questions

Is a PLC an important product under the CRA?

Not automatically: Annex III CRA does not list PLCs as a separate category. A controller is only important if its core functionality matches an Annex III category, such as router or firewall. An integrated network module does not change that (Art. 7(1)). As a product with a data connection, however, it falls under the CRA and needs a conformity assessment from 11 December 2027.

Does the CRA apply to me if I only operate machines and don't sell them?

No, not as a manufacturer. CRA obligations apply to whoever manufactures products with digital elements, or has them manufactured, and markets them under their own name (Art. 3(13)). If you have 50 or more employees, or more than €10 million in both turnover and balance sheet total, NIS2 applies to your own IT and production. Since September 2026, manufacturers have to inform you about actively exploited vulnerabilities.

Do the CRA and the Machinery Regulation apply at the same time?

Yes, both apply side by side to connected machinery. The Machinery Regulation (EU) 2023/1230 applies from 20 January 2027, the CRA in full from 11 December 2027. Recital 53 CRA makes clear that manufacturers should meet both sets of requirements. Per product, you draw up one EU declaration of conformity for all applicable legal acts (Art. 28(3) CRA).

Does a municipal utility need a CRA conformity assessment for its smart meter gateways?

No, conformity assessment is the gateway manufacturer's responsibility. Smart meter gateways are listed in Annex IV CRA. As metering point operator, the utility deploys the gateways and checks proof of conformity and the support period when purchasing. Separately, Germany generally permits only gateways with a valid BSI certificate under § 24 MsbG.