Software Lantern

For machine builders and manufacturers

As a machine builder, you can face rules at two different levels: your organization (NIS2, if you're in scope), and your product (the Cyber Resilience Act and the Machinery Regulation, which generally apply to manufacturers regardless of company size). Remote access into the machines you build or service sits at the center of both.

● in force · ○ upcoming · checked against the sources above on 19 October 2026.

Your organization: NIS2

Machinery and equipment manufacturing sits in NIS2's Annex II, point 5(d), which generally produces “important entity” status for medium and large companies, not essential. A small or micro business is generally outside this organizational scope entirely, though its customers may still push supply-chain security expectations onto it commercially, which the checker covers in detail.

Your product: the Cyber Resilience Act and the Machinery Regulation

These two generally apply to manufacturers placing a connected product on the market, regardless of company size. The Cyber Resilience Act's Article 14 reporting obligations begin, and it fully applies, on the dates shown above. The Machinery Regulation adds its own cybersecurity-related requirements for machinery; see the guide for details. Remote-access functionality on a machine is treated as a security-critical component by sources discussing the CRA's application to connected machinery.

Neither regulation names or requires a specific product or vendor.

Check your situation →