How the CRA and the Machinery Regulation Overlap
Status note (October 13, 2026): This article describes the situation in May 2025, and its facts are as of that date. Two points have moved on since then. The CRA's own standards are now being developed, with the EN 40000 series as the horizontal basis, so EN 18031 no longer has to serve as a stand-in reference for the CRA. EN 50742 is still a draft. For the current status, read Implementing the Machinery Regulation and the CRA as One Project and our page on EN 50742.
Connecting machines and industrial plants brings major benefits, but it also increases the risk of cyberattacks. Two EU acts address this risk: the Cyber Resilience Act (Regulation (EU) 2024/2847), or CRA, and the Machinery Regulation (Regulation (EU) 2023/1230). Both aim to improve the security of connected machinery and its components, but they differ in focus and scope. If you build machinery with digital components, you need to consider both.
Contents
The Cyber Resilience Act
The Cyber Resilience Act is an EU regulation that sets essential cybersecurity requirements for products with digital elements. Its aim is that hardware and software placed on the EU market can be operated securely throughout their lifecycle.
The main elements of the CRA are:
- uniform security requirements for all products with digital elements
- mandatory security updates and vulnerability handling
- a risk-based approach to product security, from design to decommissioning
- stricter conformity requirements for certain product categories
The CRA takes a horizontal approach. It applies to all products with digital elements, whatever their intended purpose, and requires manufacturers to build security measures into the development process.
Harmonized standards to implement the requirements are currently being developed. Until they are published, established standards offer a practical frame of reference: IEC 62443-4-1 for the secure development process and EN 18031 for technical requirements for radio equipment.
The Machinery Regulation
The Machinery Regulation replaces the previous Machinery Directive (Directive 2006/42/EC) and adds cybersecurity to the essential health and safety requirements. Manufacturers will also have to address risks from digital manipulation specifically.
The main changes in the Machinery Regulation are:
- cybersecurity as part of the essential health and safety requirements
- protection against intentional and accidental corruption, for example of control systems (Annex III, section 1.1.9)
- requirements on the reliability of control systems (Annex III, section 1.2.1)
- documentation requirements that make security measures traceable
For the technical implementation, the standard EN 50742 is currently being developed (“Safety of machinery – Protection against corruption”, currently available as the final draft FprEN 50742:2026). It specifies the requirements of Annex III. In particular, it addresses technical and organizational measures against unwanted intervention across the entire lifecycle.
What the CRA and the Machinery Regulation share, and where they differ
Both the CRA and the Machinery Regulation aim for a high level of security for connected devices and machinery. Both require security measures across the entire lifecycle and rely on documentation and evidence.
The CRA governs the security of all products with digital elements, regardless of their intended purpose. The Machinery Regulation, by contrast, focuses on the safety requirements for machinery and its control systems. So the CRA has the broader focus, while the Machinery Regulation goes into more detail and addresses sector-specific risks.
For machinery that contains digital elements and falls under both regulations, manufacturers can use synergies. The CRA's requirements on vulnerability handling and security updates help you meet the requirements of the Machinery Regulation. This applies in particular to protection against corruption and reliable control systems.
Standards for implementation: IEC 62443, EN 18031, and EN 50742
Several standards and technical specifications are in focus for implementing the requirements of the CRA and the Machinery Regulation in practice. This is the case even though no harmonized standards under the CRA have been published yet.
The IEC 62443 series is an internationally established series of standards for industrial automation and control systems. Experts and standardization bodies use two parts in particular as a central reference for many CRA requirements: IEC 62443-4-1 (requirements for secure development processes) and IEC 62443-4-2 (technical requirements for components). They serve as a basis for developing future harmonized standards under the CRA.
EN 18031 was developed under the delegated regulation to the Radio Equipment Directive (RED), Commission Delegated Regulation (EU) 2022/30. It contains specific cybersecurity requirements for connected products. It is also seen as a starting point for developing future harmonized standards that support the CRA, especially for devices with radio or network interfaces. EN 18031 is not explicitly aligned with the CRA. Its structure and level of detail, however, already make it usable as a reference in practice.
For the Machinery Regulation, EN 50742 is currently being developed. It addresses the requirements of Annex III of the Machinery Regulation directly, in particular protection against corruption and the integrity of control systems. Once completed, it is expected to be listed as a harmonized standard under the Machinery Regulation.
What this means for manufacturers
Manufacturers of machinery with digital components will have to consider both the CRA and the Machinery Regulation. Cybersecurity thus becomes a fixed part of product development, risk management, and technical documentation.
In practice, you must plan security requirements such as vulnerability handling, security updates, and protection against corruption early. You must then implement them across the entire lifecycle. At the same time, the requirements for evidence and conformity assessment increase.
Standards such as IEC 62443, EN 18031, and, in future, EN 50742 help you implement these requirements systematically and use synergies between the two acts.
Assessment: treat both acts as one task
The CRA and the Machinery Regulation make clear that cybersecurity must not be treated in isolation. You must build security requirements into development, maintain them across the entire product lifecycle, and document them.
Applying established standards such as IEC 62443, EN 18031, and the upcoming EN 50742 will be decisive. They help you implement the regulatory requirements efficiently and improve the security of machinery and control systems in the long term.
Support with implementation
The CRA and the Machinery Regulation set cybersecurity requirements for products and machinery. For many manufacturers, implementing them takes considerable effort. This concerns technical protection, changes to internal processes, and evidence for authorities and testing bodies.
Secuvise helps companies understand regulatory requirements and implement them systematically. We support you with initial orientation, concrete implementation steps, and preparation for a conformity assessment. The aim is practical solutions that meet the requirements and fit your existing development processes.
More at secuvise.com.
