Cyber Resilience Act (CRA) and New Machinery Regulation 2023/1230: The Cybersecurity Requirements Now Facing Mechanical Engineering

The Cyber Resilience Act (CRA) and the new EU Machinery Regulation (EU) 2023/1230 are fundamentally changing the requirements for machine manufacturers. For anyone developing, producing, or placing networked machines, industrial control systems, and digital components on the market in the EU today, cybersecurity will in the future become just as mandatory as classic functional safety.

This is not just about IT protection measures. The new specifications affect the entire product development process – from cyber risk assessment, Security by Design, and vulnerability management to CE conformity assessment.

What are the specific requirements? How do the CRA and the Machinery Regulation differ? And what measures should machine builders take now? This article answers the most important questions.

In Brief

• The Cyber Resilience Act (CRA) obliges manufacturers to implement Security by Design, vulnerability management, and security updates.
• The Machinery Regulation requires machines to be protected against manipulation ("corruption").
• Both sets of rules are relevant for many networked machines.
• The first CRA reporting obligations apply from September 2026.
• The Machinery Regulation applies from January 2027, and the main CRA requirements from December 2027.

What is the difference between the Cyber Resilience Act and the Machinery Regulation?

The EU Machinery Regulation and the Cyber Resilience Act pursue different goals but complement each other in terms of content.

The Machinery Regulation (EU) 2023/1230 replaces the previous Machinery Directive 2006/42/EC and regulates the safety of machines over their entire life cycle. In addition to mechanical, electrical, and ergonomic risks, it explicitly considers cyber risks for the first time. Annex III, Section 1.1.9 is particularly relevant: It requires machines to be protected against so-called "corruption" – i.e., against unauthorized changes or manipulations to software, parameters, or control systems that could impair safety-relevant functions.

The Cyber Resilience Act (CRA) applies to products with digital elements and defines binding cybersecurity requirements for them. The goal is to systematically consider security aspects during development, operation, and maintenance.

CRA or Machinery Regulation – what applies to machine builders?

In practice, the question is usually not "CRA or Machinery Regulation?" but "CRA and Machinery Regulation?".

The Machinery Regulation focuses on the safety of machines and systems. The Cyber Resilience Act, on the other hand, addresses the cybersecurity of products with digital elements. Therefore, both sets of rules are relevant for many networked machines.

Manufacturers should not consider the requirements separately. Risk assessments, development processes, technical protection measures, and CE conformity assessments will increasingly have to consider both perspectives in the future: Safety and Security.

What specific cybersecurity requirements does the Machinery Regulation entail?

The Machinery Regulation demands that machines be protected against manipulation that could impair their safety. An important technical foundation is the currently developing standard prEN 50742 "Safety of machinery - Protection against corruption". It describes concrete measures against unintentional and intentional changes:

• Access protection to machines and control systems
• Securing external interfaces such as USB and Ethernet ports
• Protection against unauthorized software versions
• Ensuring the integrity of safety-relevant functions
• Traceability of changes to hardware and software

Important: These requirements do not only apply to new developments. Significant modifications to existing machines can also trigger new conformity requirements.

What role does IEC 62443 play in mechanical engineering?

Anyone dealing with cybersecurity in mechanical engineering will quickly come across the IEC 62443 series of standards. It is internationally regarded as one of the most important standards for industrial cybersecurity and the securing of automation and control systems – even though it is neither part of the CRA nor the Machinery Regulation.

Many of the measures required in the CRA can already be found there:

• Security by Design
• Risk assessment
• User and rights concepts
• Vulnerability management
• Securing communication interfaces
• Requirements for supply chains and components

For machine manufacturers, IEC 62443 can therefore offer important guidance for the practical implementation of regulatory requirements.

What exactly does the Cyber Resilience Act (CRA) demand?

The CRA obliges manufacturers to ensure cybersecurity across the entire product life cycle. The most important requirements:

• Security by Design & Default: Cybersecurity must be considered as early as the development phase. Products must not be delivered with insecure default settings – meaning, for example, no default passwords, and unused interfaces must be deactivated.
• Cyber risk assessment: Cyber risks must be identified, assessed, and documented before placing on the market.
• Vulnerability management: Manufacturers must establish processes to systematically record, assess, and fix security vulnerabilities – even after the sale.
• Security updates: Security-relevant updates must be provided for at least five years, or correspondingly longer for a longer product life.
• Software Bill of Materials (SBOM): All software components used must be transparently documented – including open-source parts.
• Reporting obligations: Actively exploited vulnerabilities and severe security incidents must be reported to authorities within prescribed deadlines.
• CE conformity assessment: The CRA requirements become part of the conformity assessment for affected products.

What this means in practice: Anyone who has previously developed machines without systematic cybersecurity documentation must fundamentally adapt their development process – and this affects product development, purchasing, service, and quality management equally.

Which products fall under the Cyber Resilience Act?

The CRA applies fundamentally to all products with digital elements that can be connected directly or indirectly to other devices or networks. These include, among others:

• Industrial control systems
• HMI systems
• Remote service solutions
• Networked machines
• IoT devices
• Software products

The classification as a standard product, important product, or critical product determines which conformity assessment procedures apply. Machines in critical infrastructures, industrial production, or the energy sector typically fall into a higher risk class. The specific requirements that apply should therefore be checked individually for each product.

Whether a product falls under the relevant CRA categories can be checked, for example, using TÜV Süd's CRA Self-Check: https://www.tuvsud.com/de-de/dienstleistungen/produktpruefung-und-produktzertifizierung/cyber-resilience-act/cra-grafik

What impact do the CRA and the Machinery Regulation have on CE marking?

Both the Machinery Regulation and the Cyber Resilience Act have a direct impact on CE marking. Manufacturers will have to prove in the future that the relevant safety and cybersecurity requirements are met.

These include, among others:

• Documented risk assessments and cyber risk assessments
• Technical protection measures against manipulation and cyberattacks
• Processes for vulnerability management and security updates
• Traceable development and modification processes
• Documentation of software components used

For machine manufacturers, this means: Cybersecurity will in the future be an integral part of conformity assessment and technical documentation. Companies should therefore expand their existing CE processes to include security aspects at an early stage.

By when must the new requirements of the CRA and Machinery Regulation be mandatorily met?

This sounds like plenty of time – but it isn't. Development cycles in mechanical engineering are often two to four years. Those who have not yet started risk running into the deadlines with non-compliant products.

How great is the real risk from cyberattacks?

Cyberattacks on industrial systems are not an abstract future threat. According to the Bitkom Economic Report 2025, 72% of the companies surveyed rate the current threat level as high. Around 66% of German companies were affected by data theft, sabotage, or espionage last year. The damage caused by attacks on information and production systems rose by almost 20 billion euros from 2024 to 2025, reaching 73.3 billion euros.

This is particularly explosive for machine builders: Networked machines offer attackers numerous entry points – via remote maintenance access, service interfaces, external storage media, or inadequately protected network connections. The consequences range from production downtime and data theft to the manipulation of safety-relevant machine functions. Around 70% of all attacks are attributed to organized crime – so these are not isolated perpetrators, but professionally operating groups.

For machine manufacturers, cybersecurity is therefore not only becoming a compliance requirement but increasingly a competitive factor.

CRA Checklist: What machine builders should do now

Even though the essential requirements will only become mandatory in the coming years, manufacturers should act early. The following steps have proven to be sensible:

1. Analyze product portfolio: Which machines, control systems, and software components fall under the CRA?
2. Establish cyber risk assessment: Cyber risks should be systematically integrated into existing development processes.
3. Implement Security by Design: Security requirements must be considered as early as the architecture and development stages.
4. Make the software supply chain transparent: Software components used – including open-source parts – should be documented and regularly reviewed.
5. Build update and vulnerability management: Manufacturers need processes to provide security updates in the long term and handle vulnerabilities efficiently.

Why are USB and Ethernet interfaces considered particularly critical attack points?

Physical interfaces on machines are often needed for maintenance, diagnostics, updates, or parameterization. This creates risks:

• Introduction of malware via external storage media
• Extraction of sensitive machine or production data
• Manipulation of parameters or the control logic
• Installation of unauthorized software versions

Both the Machinery Regulation and the CRA therefore require measures to secure such accesses. Unused interfaces should be deactivated. Access should only be possible for authorized persons and must be traceably documented.

How can physical interfaces be technically secured?

Many manufacturers are currently looking for technical solutions to practically implement the regulatory requirements. One possibility is the 2BSecure hardware solution from SCHLEGEL. The system is installed between the interface and the end device and supports USB-A, USB-C, and Ethernet ports. Interfaces are deactivated by default and can only be activated by authorized persons using a key switch or RFID.

2BSecure can be integrated into both new machines and existing systems – without major retrofitting effort. It can be a concrete building block to technically implement and demonstrably fulfill requirements from Security by Design, interface protection, and access control.

Frequently Asked Questions about the Cyber Resilience Act and the EU Machinery Regulation (CRA and MR)

Does the Cyber Resilience Act also apply to machine builders?

Yes. The CRA applies fundamentally to products with digital elements. This also includes many networked machines, industrial control systems, HMI systems, and remote service solutions.

Do machine manufacturers have to comply with both the CRA and the Machinery Regulation?

In many cases, yes. The Machinery Regulation governs the safety of machines, while the CRA sets requirements for the cybersecurity of digital products. Both sets of rules can therefore be relevant simultaneously for networked machines.

When do the requirements of the Cyber Resilience Act come into force?

The reporting obligations for actively exploited vulnerabilities and security incidents apply from September 11, 2026. The essential requirements of the CRA become mandatory from December 11, 2027.

What role does IEC 62443 play in the CRA?

IEC 62443 is not part of the CRA but is considered one of the most important standards for industrial cybersecurity. Many of the measures described there support companies in implementing regulatory cybersecurity requirements.

What does Security by Design mean in mechanical engineering?

Security by Design means that cybersecurity is considered right from the development of a machine. Security measures are integrated into the hardware, software, and system architecture from the outset.

Why must USB and Ethernet interfaces be secured?

Unprotected interfaces can be used to introduce malware, extract data, or manipulate machine parameters. Therefore, both the CRA and the Machinery Regulation require suitable protection measures.

Conclusion: Cybersecurity becomes an integral part of product development

The Cyber Resilience Act and the new Machinery Regulation 2023/1230 are making cybersecurity a permanent part of the product responsibility of machine manufacturers over the entire life cycle. Companies should use the remaining time to align development processes, risk assessments, software supply chains, and technical protection measures with the new requirements at an early stage.

Those who start today are not only laying the foundation for regulatory compliance but are also strengthening the security and future viability of their products.

Sources and further information

Legislation and standards

• Regulation (EU) 2023/1230 on machinery (Machinery Regulation)
• Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act)
• IEC 62443 – IT security for industrial automation systems
• prEN 50742 – Safety of machinery – Protection against corruption

Studies and statistics

• Bitkom Economic Protection 2025
• Bitkom Cybercrime Study 2025

Further information

• CRA Self-Check by TÜV Süd
• Guidelines and publications by the European Commission on the Cyber Resilience Act
• Publications by ENISA (European Union Agency for Cybersecurity)