Implementing the Machinery Regulation and the CRA as One Project
Take a connected machine controller with remote maintenance access that you place on the market from 2027. It falls under two EU acts at once: the Machinery Regulation and the Cyber Resilience Act. Many manufacturers respond by starting two separate compliance projects. That doubles the cost, even though both regulations address the same security requirements.
Contents
- At a glance
- What does it mean to implement the Machinery Regulation and the CRA together?
- Do the Machinery Regulation and the CRA really both apply to the same machine?
- Two dates of application, one time window: what applies when?
- Where do the security requirements of the Machinery Regulation and the CRA interlock?
- Conformity assessment: what you do twice and what you do once
- How do you implement the Machinery Regulation and the CRA together?
At a glance
- From 2027, connected machinery with a data connection falls under both the Machinery Regulation (Regulation (EU) 2023/1230) and the Cyber Resilience Act (Regulation (EU) 2024/2847). Neither act exempts products covered by the other.
- The dates of application differ. The Machinery Regulation applies from January 20, 2027, and the CRA from December 11, 2027. Some CRA obligations have applied since 2026.
- The security requirements interlock. The Machinery Regulation requires protection against corruption and reliable control systems, and the CRA builds on this. Meeting the CRA makes it easier to comply with the Machinery Regulation.
- If you set up risk assessment, technical documentation, and conformity assessment as one project, you avoid doing the work twice in two parallel tracks.
What does it mean to implement the Machinery Regulation and the CRA together?
It means you handle the requirements of both acts for a connected machine in one project. This covers the cybersecurity requirements of the Machinery Regulation (Regulation (EU) 2023/1230) and the requirements of the Cyber Resilience Act (Regulation (EU) 2024/2847). You do not run two separate compliance tracks. Both acts apply in parallel from 2027, but their content interlocks.
Do the Machinery Regulation and the CRA really both apply to the same machine?
Yes. Both regulations apply side by side to a connected machine, and neither displaces the other. Our article on how the CRA and the Machinery Regulation overlap explains their basic relationship in detail. This article is about practical implementation: how do you organize the obligations of both acts in one project?
What the Machinery Regulation covers and what the CRA covers
The Machinery Regulation covers machinery, interchangeable equipment, safety components, lifting accessories, chains, ropes and webbing, removable mechanical transmission devices, and partly completed machinery (Article 2 of the Machinery Regulation). Its reference point is the physical product and the hazards it creates.
The Cyber Resilience Act covers products with digital elements. Their intended purpose or reasonably foreseeable use must include a direct or indirect logical or physical data connection to a device or network (Article 2(1) of the CRA). Its reference point is the digital component and its connectivity.
The decisive difference is the point of attachment. The Machinery Regulation asks about the functional safety of the machine. The CRA asks about the cybersecurity of its digital elements. For a connected machine, both apply to the same product.
Why neither act exempts the other
The CRA expressly excludes certain product groups from its scope, such as medical devices, in vitro diagnostic medical devices, motor vehicles, certain civil aviation products, and marine equipment. Machinery under the Machinery Regulation is not on this list. No clause exempts a machine from the CRA just because it is already subject to the Machinery Regulation.
A connected machine with a data connection is subject to both the CRA and the Machinery Regulation, and it needs both conformity assessments.
| Characteristic of the machine | Machinery Regulation | Cyber Resilience Act |
|---|---|---|
| Physical machine, safety component, lifting accessory, removable mechanical transmission device | within scope (Article 2 of the Machinery Regulation) | only if it has digital elements |
| Product with digital elements and a direct or indirect data connection to a device or network | not decisive | within scope (Article 2(1) of the CRA) |
| Connected machine with control system and data connection | yes | yes |
| Medical devices, motor vehicles, and other sector-specific cases | own sector rules | excluded (Article 2(2) to (4) of the CRA) |
Two dates of application, one time window: what applies when?
The two regulations do not take effect on the same day. For project planning, this is an advantage. You can use the earlier Machinery Regulation deadline to set the pace and cover the CRA requirements in the same effort.
The Machinery Regulation applies from January 20, 2027. The main obligations of the CRA apply from December 11, 2027. Some CRA obligations apply earlier. The reporting obligations for actively exploited vulnerabilities and severe incidents have applied since September 11, 2026. The chapter on the notification of conformity assessment bodies has applied since June 11, 2026.
| Date | Act | What applies from this date |
|---|---|---|
| June 11, 2026 | CRA | Rules on the notification of conformity assessment bodies |
| September 11, 2026 | CRA | Reporting obligations for actively exploited vulnerabilities and severe incidents |
| January 20, 2027 | Machinery Regulation | Machinery Regulation applies in full |
| December 11, 2027 | CRA | Main CRA obligations apply in full |
| June 11, 2028 | CRA | Transitional validity of EU-type examination certificates issued under other Union harmonization legislation ends for CRA purposes at the latest |
Where do you stand with CRA implementation?
The CRA readiness check shows in a few minutes which CRA requirements your connected machine already covers and where gaps remain, before you set up the joint project with the Machinery Regulation.
Where do the security requirements of the Machinery Regulation and the CRA interlock?
The two acts are not unrelated. The Machinery Regulation already contains its own cybersecurity requirements for machinery, and the CRA explicitly builds on them.
What the Machinery Regulation requires on security
In its annex on essential health and safety requirements, the Machinery Regulation has two sections that address cybersecurity:
- The section on protection against corruption (Annex III, section 1.1.9, of the Machinery Regulation) requires that connecting another device does not lead to a hazardous situation. Hardware relevant for safety-critical software must be protected against corruption. Software and data critical for compliance must be identified and protected, and interventions must leave evidence.
- The section on safety and reliability of control systems (Annex III, section 1.2.1, of the Machinery Regulation) requires that control systems withstand reasonably foreseeable malicious attempts from third parties. A fault in the hardware or logic of the control system must not lead to a hazardous situation. The limits of the safety functions must be established as part of the risk assessment.
How the CRA builds on this
The CRA itself recognizes this overlap. Under Recital 53 of the CRA, manufacturers whose product falls under both the CRA and the Machinery Regulation must meet both sets of requirements. The CRA also states that meeting the CRA requirements can make it easier to comply with the Machinery Regulation. You must follow the conformity assessment procedures of both regulations, and standardization should aim for consistency between the two acts.
EN 50742 and IEC 62443 as the common technical bridge
At the technical level, both sides come together in the same standards. EN 50742 is intended as the harmonized standard for the protection of machinery against corruption and addresses the corresponding section of the Machinery Regulation. The draft standard offers two routes to conformity. One is standalone. The other refers to IEC 62443-3-3 for machinery and to IEC 62443-4-2 for components, in each case combined with a development process according to IEC 62443-4-1.
For manufacturers, this means: if you build up EN 50742 and IEC 62443 for the CRA anyway, you can use the same work for the Machinery Regulation. IEC 62443 is not a special path here. It is the established state of the art for industrial cybersecurity in machine building.
EN 50742 as a common basis
EN 50742 covers the protection of machinery against corruption. It is the anchor point where the security requirements of the Machinery Regulation and the CRA presumption of conformity meet in practice.
Conformity assessment: what you do twice and what you do once
Two regulations mean two conformity assessments. That is the bad news. The good news is that much of the underlying content is the same, and a transitional rule for cybersecurity evidence avoids duplicate testing.
Under the Machinery Regulation, the risk category determines the procedure. The Machinery Regulation lists high-risk machinery in two lists in its Annex I. For these categories, it sets stricter conformity assessment procedures. For Annex I, Part A, you must always involve a notified body. For Annex I, Part B, internal production control is possible only if you apply harmonized standards or common specifications covering all relevant essential health and safety requirements (Article 25 of the Machinery Regulation).
The CRA, in turn, classifies products by their cybersecurity risk. For most products with digital elements, the manufacturer can carry out the assessment itself using internal control (module A). Important and critical products are subject to stricter procedures:
- Important products, class I: Internal control is only possible if you fully apply harmonized standards, common specifications, or a European cybersecurity certification scheme at assurance level at least “substantial”. Otherwise, you must involve a notified body (module B+C or module H).
- Important products, class II: A notified body (module B+C or module H) or, where available, a scheme under the Cybersecurity Act at assurance level at least “substantial”.
- Critical products: A European cybersecurity certification scheme where required, otherwise the procedures for class II (Article 32 of the CRA).
Under the CRA, however, a connected machine typically does not fall into these special categories unless it performs their core functionality.
For evidence, the CRA provides a transitional rule. EU-type examination certificates issued under other Union harmonization legislation, including the Machinery Regulation, remain valid until June 11, 2028, unless they expire earlier (Article 69(1) of the CRA).
The European Commission's guidance on the application of the Cyber Resilience Act explains how this rule works in practice. The guidance is not legally binding, but it shows how the rules are to be interpreted. According to the guidance, a valid EU-type examination certificate under the Machinery Regulation does not exempt you from a full CRA cybersecurity risk assessment or from your other CRA obligations. In your conformity assessment, you can rely on the certificate as evidence where it already covers the relevant risks. Examples are the risks from the sections on protection against corruption and on control systems. For CRA purposes, this option ends on June 11, 2028, even if the certificate remains valid beyond that date. If your CRA risk assessment identifies additional cybersecurity risks that the certificate does not cover, you remain responsible for them under the CRA.
| Project component | Covers |
|---|---|
| Risk assessment and risk evaluation | both (one joint process is possible) |
| Technical documentation | both (separate evidence sections, common basis) |
| Conformity assessment | both (a separate procedure under each regulation) |
| Reporting channels and vulnerability handling | CRA |
The “both” entries reflect our consulting experience, not an explicit requirement of the regulations. They show where you can usefully bundle project components and where an obligation exists in only one of the two acts. The CRA requires reporting channels and ongoing vulnerability handling. The Machinery Regulation has no such obligations in this form.
How do you implement the Machinery Regulation and the CRA together?
The biggest lever is the risk assessment. Both regulations require a structured risk analysis as the basis. In our experience, one joint assessment process meets the requirements of both acts, so you do not have to go through it twice. This is a practical assessment: the regulations do not prescribe this specific process, but you can combine it so that it satisfies both.
In our consulting work, four steps have proven useful as a guide for a combined project:
- Clarify the scope. Check for each machine whether it has a data connection within the meaning of the CRA and therefore falls under both acts.
- Set up one joint risk assessment. Bring functional safety and cybersecurity together in one process, for example along IEC 62443-4-1.
- Use evidence twice. Structure your evidence so that it counts for both regulations through the presumption of conformity and, where applicable, the transitional rule.
- Plan the conformity assessment by risk category. Determine early which procedures require a notified body, and plan the project around the earlier Machinery Regulation deadline.
This turns two sets of obligations into one project with a common basis and two compliance targets.
Set up the Machinery Regulation and the CRA as one project
Talk to us about organizing risk assessment, technical documentation, and conformity assessment for both regulations in one joint project instead of two separate compliance tracks.
