What do the CRA and the Machinery Regulation each require?
The table sets out where the two regulations meet for a machine with firmware. Every row names the provision in the Official Journal.
| Topic | CRA, (EU) 2024/2847 | Machinery Regulation, (EU) 2023/1230 |
|---|---|---|
| Applies from | 11 Dec 2027, Art. 14 from 11 Sep 2026 (Art. 71(2)) | 14 Jan 2027 (Art. 54) |
| Protection goal | Cybersecurity of the product with digital elements | Health and safety, including protection against corruption and safe control systems |
| Name the software | Software bill of materials, at the very least the top-level dependencies (Annex I Part II(1)) | Identify the software installed that is necessary to operate safely and provide that information at all times in an easily accessible form (Annex III 1.1.9) |
| Record interventions | Provide security related information by recording and monitoring relevant internal activity, with an opt-out mechanism for the user (Annex I Part I(2)(l)) | Collect evidence of interventions in the software and of modifications to the software or its configuration (Annex III 1.1.9) |
| Versions after placing on the market | Security updates that remediate vulnerabilities (Annex I Part II(2)) | Tracing log of safety software versions uploaded, kept for five years after upload (Annex III 1.2.1(f)) |
| Declaration of conformity | A single one for all relevant Union acts (Art. 28(3)) | A single one for all relevant Union acts (Art. 21(3)) |
What does Annex III 1.1.9 of the Machinery Regulation require?
Connecting another device, directly or through a remote device, must not lead to a hazardous situation. Software and data critical for compliance with the health and safety requirements "shall be identified as such and shall be adequately protected against accidental or intentional corruption".
Two duties reach the firmware directly: "The machinery or related product shall identify the software installed on it that is necessary for it to operate safely, and shall be able to provide that information at all times in an easily accessible form." And it "shall collect evidence of a legitimate or illegitimate intervention in the software or a modification of the software installed on the machinery or related product or its configuration."
What does Annex III 1.2.1 of the Machinery Regulation require?
Control systems must withstand, where appropriate to the circumstances and the risks, the intended operating stresses and intended and unintended external influences, "including reasonably foreseeable malicious attempts from third parties leading to a hazardous situation" (point (a)). A fault in the hardware or the logic of the control system must not lead to hazardous situations (point (b)).
Point (f) requires a tracing log of the data generated in relation to an intervention and of the versions of safety software uploaded after placing on the market or putting into service. It is enabled for five years after the upload, exclusively to demonstrate conformity further to a reasoned request from a competent national authority.
Does meeting the CRA automatically cover Annex III 1.1.9 and 1.2.1?
No. Recital 53 of the CRA says compliance with its essential cybersecurity requirements "could facilitate the compliance with the essential requirements" of the Machinery Regulation that cover certain cybersecurity risks, in particular Annex III 1.1.9 and 1.2.1. The manufacturer has to demonstrate such synergies, for instance through harmonised standards following a risk assessment, and follows the conformity assessment procedures of both regulations.
Besides harmonised standards (Art. 20(1)), the Machinery Regulation provides a specific route for 1.1.9 and 1.2.1: machinery certified, or with a statement of conformity, under a cybersecurity certification scheme adopted under Regulation (EU) 2019/881 whose references are published in the Official Journal is presumed to conform, insofar as the certificate or statement covers those requirements (Art. 20(9)). The Machinery Regulation has no presumption based on CRA conformity alone. The CRA provides for guidance for manufacturers also subject to other Union harmonisation legislation in Art. 26(2)(c).
What should a machinery manufacturer with firmware do now?
The Machinery Regulation applies almost eleven months before the CRA. A manufacturer who can name the safety-relevant software of the machine and record interventions by 14 January 2027 has part of the basis the CRA needs from 11 December 2027 for the software bill of materials and vulnerability handling.
- 1
Check whether the machine is a product with digital elements with a data connection: firmware and an interface that carries data.
- 2
Record the installed software per controller, with its version, and mark what is necessary to operate safely (Annex III 1.1.9).
- 3
Derive the software bill of materials and the known vulnerabilities per component from the same list (CRA Annex I Part II(1) and (2)).
- 4
Log interventions and uploaded versions of safety software (Annex III 1.1.9 and 1.2.1(f)).
- 5
Prepare a single EU declaration of conformity for both regulations (MR Art. 21(3), CRA Art. 28(3)).
Questions
Does the CRA apply to every machine?
Only to machinery that is a product with digital elements whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network (CRA Art. 2(1)). A machine with a controller and firmware that exchanges data over an interface usually meets that.
Which applies first?
The Machinery Regulation, from 14 January 2027 (Art. 54). The CRA applies from 11 December 2027, and its obligation to report actively exploited vulnerabilities and severe incidents since 11 September 2026 (Art. 71(2)).
Does CRA conformity replace the check against Annex III 1.1.9 and 1.2.1?
No. It could facilitate it, but the manufacturer has to demonstrate that (CRA, recital 53). The Machinery Regulation provides a presumption of conformity for those points through harmonised standards published in the Official Journal (Art. 20(1)) and through certification under Regulation (EU) 2019/881 (Art. 20(9)), not through CRA conformity.
Do I need two declarations of conformity?
No. Where a product is subject to more than one Union act requiring an EU declaration of conformity, the manufacturer draws up a single one for all of them, naming the acts and their publication references (MR Art. 21(3), CRA Art. 28(3)). For partly completed machinery the Machinery Regulation requires an EU declaration of incorporation instead (Art. 22); the CRA declaration of conformity stands next to it.
Have the Machinery Regulation dates changed?
Not as of 11 November 2026. The regulation has been amended twice, by (EU) 2024/2748 on internal market emergency procedures and by (EU) 2026/1744. Neither changes Art. 54 or Annex III 1.1.9 and 1.2.1. (EU) 2026/1744 adds Art. 20(10) and empowers the Commission to amend Annex III for high-risk systems under Regulation (EU) 2024/1689; (EU) 2024/2748 inserts emergency procedures (Chapter IVa).