What the Cyber Resilience Act requires
The CRA covers products with digital elements whose intended use includes a direct or indirect connection to a device or a network. Among other things, the manufacturer must:
- design the product with a level of cybersecurity appropriate to the risks, with no known exploitable vulnerabilities when it is sold;
- provide secure default settings and security updates for the support period;
- handle vulnerabilities throughout that period and document the software components;
- report actively exploited vulnerabilities and severe incidents.
The dates to note
- 11 September 2026: the obligations to report actively exploited vulnerabilities and severe incidents apply.
- 20 January 2027: the Machinery Regulation applies, with its requirements on protection against corruption and on control systems.
- 11 December 2027: all other CRA obligations apply.
Reports have short deadlines, measured in hours and days: it pays to have a process ready before you need it.
The CRA and the Machinery Regulation
The Machinery Regulation has its own requirements on protection against corruption and on safety-related control systems: an attack or tampered software must not lead to hazardous situations. The CRA looks at the product's cybersecurity in general, for its whole life. Both can apply to the same machine.
If you buy components with digital elements, such as PLCs or industrial routers, their manufacturers have their own obligations. What your machine needs is still to be assessed with your consultant.
What to do in practice
- Take an inventory of the software and firmware installed, by model and by serial number.
- Decide the support period and how to deliver security updates.
- Set up a channel to receive vulnerability reports and a process to notify them on time.
In TARGA every serial number has its software version history, with dates and release notes, useful both for the CRA and for substantial modifications.
Frequently asked questions
Does the Cyber Resilience Act already apply?
The obligations to report actively exploited vulnerabilities and severe incidents apply from 11 September 2026. The other obligations apply from 11 December 2027.
Does a machine without an internet connection fall under the CRA?
The CRA covers products whose intended use includes a direct or indirect connection to a device or a network, not only to the internet. A service port or a factory network can be enough. It needs case-by-case assessment.
If I use PLCs that already comply with the CRA, am I covered?
Not necessarily. The PLC manufacturer is responsible for the PLC; whoever places the machine on the market must assess the machine as a whole, including the software, networks and remote access they add.