The Cyber Resilience Act for machine builders

Last updated: October 19, 2026

Regulation (EU) 2024/2847 (the Cyber Resilience Act) requires manufacturers of connected machinery and other products with digital elements to build in cybersecurity before placing them on the EU market, with obligations phased in from 2026. It regulates the product itself, not your organization, and names no specific technology.

Dates that matter

Article 71, “Entry into force and application,” sets a phased timeline:

“This Regulation shall apply from 11 December 2027. However, Article 14 shall apply from 11 September 2026 and Chapter IV (Articles 35 to 51) shall apply from 11 June 2026.”

Article 14 is “Reporting obligations of manufacturers.” Chapter IV is “Notification of conformity assessment bodies.” Source: Regulation (EU) 2024/2847, Art. 71(2), checked 19 October 2026

Scope

“This Regulation applies to products with digital elements made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network.”

Industrial control systems and connected machinery fall within that description. Excluded: medical devices, motor vehicles, civil aviation, marine equipment, and defence. Source: Regulation (EU) 2024/2847, Art. 2(1), checked 19 October 2026

Why remote access matters here specifically

Several sources discussing the CRA's application to machinery describe remote access functionality on a machine as a security-critical component: a weak or uncertified remote connection is treated as a way the product itself fails to be secure by design, with responsibility resting on the manufacturer. The regulation does not name a required technology for this, such as a VPN or a specific gateway product.

How this differs from NIS2

NIS2 regulates your organization. The CRA regulates your product. A machine builder can be subject to one, the other, both, or neither, depending on its own size and sector (NIS2) versus simply placing a connected product on the EU market (the CRA, which isn't gated by company size the way NIS2 is).

Related guides

The Machinery Regulation's cybersecurity requirements and NIS2, the CRA, the Machinery Regulation, and IEC 62443.

This is a general guide based on published sources, not legal advice. Confirm your specific obligations with a qualified advisor.