Does the EU Cyber Resilience Act apply to machine builders?

If you build machines that contain software or firmware and sell them in the EU, the short answer is: very probably yes. The EU Cyber Resilience Act (Regulation (EU) 2024/2847) applies to "products with digital elements" placed on the EU market — and a modern industrial machine, with its controllers, firmware and connectivity, is squarely that.

What "products with digital elements" means

A product with digital elements is any software or hardware product — and its remote data-processing solutions — whose intended or reasonably foreseeable use includes a data connection to a device or network. In practice, if your machine runs firmware, embeds a PLC or IPC, or can be maintained remotely, it qualifies. Purely mechanical or electrical equipment with no digital elements is outside the CRA — but the moment a variant adds software or connectivity, that variant comes into scope.

It is extraterritorial

Being based outside the EU does not put you out of reach. The CRA applies to any manufacturer that places products on the EU market, wherever it is headquartered. Importers and distributors carry their own duties too. If your machines reach EU customers — directly or through a distributor or system integrator — plan as though you are in scope.

Being in scope does not all land at once

This is the point most summaries get wrong. The obligations arrive in waves:

• 11 September 2026 — Article 14 incident reporting begins. You must report actively-exploited vulnerabilities and severe incidents. This applies even to products already in the field.
• 11 December 2027 — full application: SBOM, secure-by-design, vulnerability handling, technical documentation, CE marking and conformity assessment (Article 13 / Annex I).

So the near-term task is not "become fully CRA-compliant" — it is to be ready to detect and report by September 2026. Conflating the two leads teams to either panic or procrastinate.

What about conformity class?

Around 90% of products fall in the default class, where the manufacturer self-assesses, issues an EU declaration of conformity, and keeps technical documentation. "Important" and "critical" classes face stricter assessment, sometimes involving a third party. Most machine builders are in the default class — but confirm your classification rather than assume it.

A quick way to check

Our free CRA Scope Check walks you through five questions and gives an indicative read on your scope and the deadlines that apply to you. It is not legal advice, but it is a fast, honest starting point — and it points you at the one deadline that is closest: Article 14 readiness.