IEC 62443, explained
Last updated: October 19, 2026
IEC 62443 is a voluntary international standard, not a regulation. No EU law, national or otherwise, makes conformance to it mandatory by itself. This page exists specifically to say that plainly, since it's commonly described in ways that blur it with NIS2, the Cyber Resilience Act, or the Machinery Regulation, all of which are actual legal requirements for the entities and products they cover.
What it actually is
Properly ISA/IEC 62443, it's a series of international standards defining requirements and processes for securing industrial automation and control systems (IACS) throughout their lifecycle, developed by the ISA99 committee and co-published by the IEC. It addresses asset owners who operate systems, integrators and service providers who design and maintain them, and product suppliers who build their components.
When it becomes relevant in practice
It becomes relevant commercially, not legally, when a customer, insurer, or a specific sector rule requires it contractually. The same distinction this site draws for NIS2 Article 21(2)(d)'s supply-chain pressure applies here too: a customer can require IEC 62443 conformance as a condition of doing business, which is real and worth preparing for, without that making it a general legal requirement.
Related guides
IEC 62443 and remote access for machine builders and NIS2, the CRA, the Machinery Regulation, and IEC 62443.
It takes about 2 minutes and covers NIS2, the Cyber Resilience Act, and the Machinery Regulation for machine builders, factory operators, and system integrators in the Netherlands, Belgium, and Luxembourg.
This is a general guide based on published sources, not legal advice. Confirm your specific obligations with a qualified advisor.