The CRA is in force: what its 2026 deadlines change in your specifications now

The EU Cyber Resilience Act, Regulation (EU) 2024/2847, entered into force on 10 December 2024, but it phases in. Two dates matter. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents affecting their products with digital elements. From 11 December 2027, most of the remaining obligations apply, including the essential cybersecurity requirements themselves.

Reporting already applies; the rest follows in December 2027. For a machine builder who has never run a vulnerability disclosure process, that leaves little room.

Why a plant operator should care about a product regulation

The CRA does not regulate you as an operator. It regulates the people who sell you machines, PLCs, HMIs, gateways and the software that runs on them. That changes what you can ask for in a purchase order, and what you should expect to hear, without having to chase, when one of your suppliers finds a hole in something installed on your line.

What the reporting obligation looks like

Article 14 sets the sequence for an actively exploited vulnerability: an early warning within 24 hours of the manufacturer becoming aware of it, a fuller notification within 72 hours, and a final report no later than 14 days after a fix or mitigation is available. Severe incidents affecting the security of a product follow the same 24-hour and 72-hour steps, with a final report within one month. Reports go to the national CSIRT acting as coordinator and to ENISA, through a single reporting platform. The manufacturer must also inform the users concerned, and tell them what they can do to mitigate. And it reaches back: Article 69(3) applies these obligations to every product in scope placed on the market before 11 December 2027, so the equipment already running on your line is covered too.

For you, the duty to inform users is the useful part. Somebody at the supplier will need to know which customers run the affected firmware, and how to reach them. If your installed base is not on their list, you will hear about it from the trade press.

The product classes, in plain terms

• Default: most products with digital elements. The manufacturer assesses conformity itself. In most cases, that is where a PLC or an operator panel sits.
• Important, class I: among others password managers, VPNs, network management systems, operating systems, routers, modems and switches, microprocessors and microcontrollers with security functions. Self-assessment is allowed if the manufacturer applies harmonised standards or equivalent; otherwise, third-party assessment.
• Important, class II: hypervisors and container runtimes, firewalls, intrusion detection and prevention systems, tamper-resistant microprocessors and microcontrollers. Third-party assessment.
• Critical: hardware devices with security boxes, smart meter gateways, smart cards and secure elements. A European cybersecurity certificate where a Commission delegated act requires one; otherwise the class II route.

What decides the class is the product’s core functionality. And integrating a class I component, say a managed switch inside a packaging machine, does not by itself put the whole machine into class I (Article 7(1)).

Three things to put in your next specification

We now add these to every equipment specification we write for a client:

• A named contact and a committed channel for vulnerability disclosure, with a response time, and a commitment to tell you when a vulnerability affects what you bought.
• A software bill of materials for the delivered product, updated with each firmware release. The CRA requires manufacturers to draw one up; it does not oblige them to hand it over, so ask for it in the contract.
• A written support period, and what happens to security updates when it ends. The CRA sets a floor of five years, unless the product is expected to be used for less, and its recitals point out that industrial control systems often stay in use much longer than that.

A machine you buy today will still be on your line in 2040. The support commitment is a line in the specification, not a courtesy.

None of this turns you into a CRA expert. It only needs your purchasing template to ask three questions it probably does not ask yet.

References

• Regulation (EU) 2024/2847 (Cyber Resilience Act), Articles 7, 13, 14, 69 and 71, Annexes I, III and IV: eur-lex.europa.eu.