CEMA Guidance on CRA Compliance for Agricultural Machinery
In December 2025, CEMA, the European association of agricultural machinery manufacturers, published guidance on interpreting the Cyber Resilience Act. The document addresses the main questions of interpretation that arise when the regulation is applied to agricultural machinery. It is an industry interpretation aid and is not legally binding. Each manufacturer remains responsible for the conformity of its own products.
Contents
Why agricultural machinery needs its own reading of the CRA
The Cyber Resilience Act (Regulation (EU) 2024/2847), or CRA, has been in force since December 10, 2024. It applies in stages: the rules on conformity assessment bodies since June 11, 2026, the reporting obligations since September 11, 2026, and all other obligations from December 11, 2027. It covers almost all products with digital elements placed on the EU market.
For manufacturers of machinery and plant, this means that almost every machine with electronic components and a data connection falls within the scope of the regulation. The connection can be USB, Bluetooth, GPS, or OBD.
Many regulations rest on a long history of standards. The CRA does not yet have the harmonized standards that would give manufacturers a presumption of conformity. In this period of uncertainty, sector guidance such as the CEMA document helps an industry build a shared understanding. It also prepares the dialog with standardization committees and market surveillance authorities.
The CEMA guidance focuses on questions that follow from the particular structure of the agricultural machinery sector:
- complex value chains with many suppliers
- long product lifecycles
- updates distributed mostly through dealer networks rather than centrally
- a wide range of products, from simple implements to fully connected precision machines
How the CRA fits with other EU legislation
The CRA does not stand alone. It is part of a wider body of EU legislation in which different acts address different aspects of product safety and cybersecurity.
The Machinery Regulation (Regulation (EU) 2023/1230) sets the essential health and safety requirements for machinery, including functional safety. The CRA adds specific cybersecurity requirements for digital elements. The two apply in parallel insofar as their requirements do not overlap. Agricultural machinery is usually subject to both: the Machinery Regulation for mechanical and functional safety, and the CRA for the cybersecurity of the integrated electronic components and systems.
The NIS2 Directive (Directive (EU) 2022/2555) works differently. It does not regulate products. It sets cybersecurity obligations for essential and important entities and their own network and information systems. Farms are usually not covered by NIS2. Machinery manufacturers can be covered as companies under Annex II of NIS2, but those obligations concern their own systems, not the machines they sell. The CRA can still create an indirect link to NIS2 when products are used in critical sectors and classified as critical products under Annex IV of the CRA.
The Blue Guide on the implementation of EU product rules is the central reference for basic terms such as “placing on the market,” “making available on the market,” and “substantial modification.” The CEMA guidance takes up these terms and applies them to the specific conditions of agricultural machinery.
One difference from sector-specific legislation matters here. Article 2(5) of the CRA allows the CRA to be limited or excluded where other EU rules achieve the same or a higher level of protection. For agricultural machinery, no such legislation is currently in sight that could displace the CRA. The CRA therefore applies in full.
Where the Machinery Regulation, the CRA, and other EU rules meet, questions of demarcation come up often in practice. If you want to clarify which requirements apply to your machines in parallel and where they overlap, a short call can help.
Horizontal and vertical harmonization
For the essential cybersecurity requirements in Annex I of the CRA, the CRA takes a risk-based approach. Manufacturers must carry out a cybersecurity risk assessment and ensure an appropriate level of security on that basis. Harmonized European standards will specify these requirements in detail once they are available.
Two kinds of standards are relevant for the CRA. Horizontal standards apply across all products. Vertical standards set out requirements for particular sectors or product groups.
The EN 40000 series is being developed as the horizontal standard for the CRA and is meant to cover the basic cybersecurity requirements for all product categories. In parallel, ETSI is developing vertical standards tailored to specific product groups (the ETSI EN 304 6xx series).
For agricultural machinery, the IEC 62443 series is particularly important. It was originally developed for industrial automation systems and is increasingly used for embedded systems in machinery as well. IEC 62443 provides a structured method for security requirements at component and system level and for the secure development lifecycle.
Standards are not laws. They provide a presumption of conformity, but applying them is not mandatory. Manufacturers can also demonstrate conformity with the essential requirements of the CRA through other technical solutions. Applying harmonized standards does, however, make conformity assessment easier and gives legal certainty.
Scope, shared responsibility, and support periods
The CEMA guidance concentrates on the topics that matter most to manufacturers of agricultural machinery.
Scope and definitions
The CRA covers all products with digital elements whose intended purpose or reasonably foreseeable use includes a data connection to a device or network. What counts is not whether the connection exists permanently, but whether a data connection is technically possible.
The CEMA guidance makes this explicit. An agricultural machine falls within scope if at least its intended purpose or its reasonably foreseeable use allows a data connection. That can be a diagnostic interface used only during maintenance, or a JTAG port on a microcontroller intended for firmware updates.
The line between “reasonably foreseeable use” and “reasonably foreseeable misuse” matters in practice:
- Reasonably foreseeable use covers all scenarios that follow from the functions provided, even if the instructions do not describe them explicitly.
- Misuse means use outside the intended context that requires specialist knowledge a typical user does not have.
Substantial modification
Under the CRA, a substantial modification is a change after placing on the market that affects compliance with the essential cybersecurity requirements or changes the intended purpose. The party making any change must analyze its impact and document that analysis, even if the change is not classed as substantial.
A substantial modification has a clear consequence. The party that made it becomes the manufacturer under the CRA and must go through the conformity assessment procedure again. This also applies to changes to spare parts that can no longer be considered identical.
OEM and supplier roles and due diligence
How responsibility is shared between manufacturers (OEMs) and component suppliers is one of the most complex questions in implementing the CRA. Article 13(5) of the CRA requires manufacturers to exercise due diligence when integrating third-party components so that these do not compromise the cybersecurity of the overall product.
The CEMA guidance is clear that the OEM bears overall responsibility for the conformity of the end product. Its due diligence covers three things:
- selecting suitable components based on its own risk assessment
- checking whether the supplier's declaration of conformity covers the CRA
- integrating and configuring the component according to the supplier's instructions
If a component is made available on the market separately and carries the CE marking, the OEM's due diligence becomes simpler. If the component is made only for integration and is not placed on the market separately, the parties can allocate responsibility by contract. In every case, the supplier must provide enough information for the OEM to carry out its due diligence.
The split of responsibility between OEM and suppliers is one of the most critical points in implementing the CRA. We are happy to discuss in a no-obligation call how to structure due diligence obligations, contractual arrangements, and technical evidence.
Components for integration and secure by default
The CEMA guidance deals with one very practical question in a separate section. May components intended for integration into an end product be supplied without their security functions activated?
The answer is yes, under certain conditions. The reasoning: a component that is already fully configured and secured is much harder to integrate. The OEM would first have to deactivate security functions to carry out the integration and then reconfigure them, which can create additional attack surface.
Take a control unit with a cryptographic module that is shipped without pre-provisioned keys and with its privileged functions deactivated. During integration, the OEM can load the keys and activate the security functions without needing to authenticate.
The condition is that the supplier gives the OEM precise instructions on how to configure the component securely after integration (Annex II, point 8(f) of the CRA). All necessary security functions must be present when the component is made available on the market. They just do not have to be activated yet.
This interpretation allows a practical division of work along the supply chain without putting the aim of the CRA, a secure end product, at risk.
Support periods
The CRA requires manufacturers to handle vulnerabilities during a defined support period. This period must reflect the time the product is expected to be in use. It must be at least five years, unless the product is expected to be in use for less than five years.
For agricultural machinery, CEMA recommends a support period of at least ten years; the decision rests with each manufacturer. The reasoning: agricultural machinery typically has long service lives. Many tractors stay in service much longer, but they are usually used at full capacity as the main working vehicle only in their first years, up to about eight, and are then kept as secondary vehicles. Tractors are also built in the highest numbers per type and are therefore expected to be the prime target for cyberattacks. In addition, relatively few machines are connected: according to CEMA, around 20 percent of updates are delivered over the air and about 80 percent through dealers.
The ten-year support period comes with two conditions:
- Suppliers of components that provide core functions must keep delivering the necessary information for the same period.
- External factors that affect compatibility, such as obsolete development tools or lost expertise, must not make updates impossible.
CEMA also recommends keeping each update available for download and installation for ten years after its release. The CRA itself requires in Article 13(9) that security updates made available during the support period remain available for at least ten years after issue or for the rest of the support period, whichever is longer.
Common misunderstandings
The CEMA guidance also addresses several frequent misreadings of the CRA.
Spare parts
Identical spare parts, made to the same specifications as the components they replace, are excluded from the CRA. This applies regardless of whether the original product is still in production or its support period has already ended. It applies only to genuinely identical parts. If a component is modified because of obsolescence, you must check whether this amounts to a substantial modification.
Tailor-made products
For tailor-made products, the CRA allows contractual deviation from the essential cybersecurity requirements. This concerns products developed for a specific business purpose and a specific business customer, where both parties have explicitly agreed different contractual terms. Components co-designed by two or more economic operators are a different case. In CEMA's view, such components are not tailor-made products but fall outside the CRA altogether. CEMA bases this on the Blue Guide, under which an offer or agreement made before manufacture is complete is not yet placing on the market.
Important and critical products
Annexes III and IV of the CRA list product categories that are subject to stricter conformity assessment procedures. What counts is the core functionality of the product. If a component listed in Annex III or IV is integrated into an end product, the end product does not automatically take on the classification of the component. The exception is when the end product itself has the core functionality of the listed product category.
Free and open-source software
The CRA also covers free and open-source software (FOSS) components when they are integrated into a commercial product. The manufacturer of the end product is responsible for handling vulnerabilities in all integrated FOSS components, even if the original developer has no commercial relationship with it.
Guidance for the preparation phase
The CEMA guidance shows how industry associations can give their members direction before new rules apply. It does not replace the regulation itself or the future harmonized standards, and it is not legally binding. It still serves a useful purpose: it creates a shared understanding within an industry of questions of interpretation that arise from the characteristics of the sector.
For manufacturers of agricultural machinery, the CRA means considerable changes in development processes, supplier management, and support structures. Preparation should start early, even though the regulation only applies in full from December 2027. The main fields of action are:
- setting up vulnerability handling
- clarifying the split of responsibility with suppliers, both contractually and technically
- defining support periods
- adapting the technical documentation
Over the coming months, further harmonized standards, implementing acts from the Commission, and the practice of market surveillance authorities will make the interpretation of the CRA more concrete. Sector guidance such as the CEMA document helps ensure that this process takes appropriate account of the technical and economic realities of the sectors concerned.
Sector guidance such as the CEMA document gives useful direction, but it does not replace an assessment of your own situation. If you want to understand what the CRA means for your products, your supply chain, and your support strategy, we can work through it in a no-obligation call.
