Does this really apply to all the old machines?

The second practice case began inside our own company. The question was asked internally before any customer ever asked it, and that is the strongest signal that it deserves a public answer. Again in five fixed sections, again with the section that says what the product does not solve.

The situation

A manufacturer of filling and packaging lines, thirty years in the market, with machines in the field from three controller generations. The oldest still run on a controller the supplier discontinued in 2016. When the reporting duty took effect on 11 September 2026, the question came from engineering: "Surely this only applies to the machines of the last five years?" Then from sales: "We don’t even sell the old lines any more." Then from the customer: "You delivered the line in 2014 — what does the CRA have to do with me?"

What the law requires

Two paragraphs of Article 69 answer the question, and both have to be read. Paragraph 2 is the grandfathering rule: products with digital elements placed on the market before 11 December 2027 are subject to the Regulation’s requirements only if they are substantially modified from that date. A line delivered in 2014 therefore needs no retrofitted software bill of materials, no CE marking under the CRA and no Annex I conformity assessment, as long as it is not substantially modified.

Paragraph 3 is the exception that counts. By way of derogation from paragraph 2, Article 14, the reporting duty, applies to all products with digital elements within the scope of the Regulation that were placed on the market before 11 December 2027. All of them. No lower date bound, no age limit, no exemption for discontinued, no-longer-sold or no-longer-supported products. The 2014 line has been subject to the reporting duty since 11 September 2026 if an actively-exploited vulnerability in it becomes known or it is affected by a severe incident.

The five-year figures that come up in every conversation stem from other provisions and do not limit the reporting duty:

• Article 13(8) of the CRA requires a support period of at least five years — or the expected product lifetime, if shorter. That governs how long security updates must be provided for a product placed on the market, not which products must be reported on.
• The Machinery Regulation requires in Annex III point 1.2.1(f) a tracing log retained for five years after each upload of safety-related software. That is no limit on Article 14 either.

Which leaves the question that decides the future of the old machines: what is a substantial modification? Article 3(30) defines it as a change after placing on the market that affects compliance with the essential cybersecurity requirements or modifies the intended purpose. Recital 39 makes clear that a security update which reduces risk and does not change the purpose is not a substantial modification, even if it constrains functionality to close a vulnerability. Whether the original manufacturer’s own conversion of an old machine is a substantial modification is, by contrast, contested: the Commission published application guidance on 27 July 2026, and the VDMA has argued that conversions by the original manufacturer should not count as substantial modifications. Only the Court of Justice interprets bindingly. Whoever decides today should document their reading: with sources, assumptions and the triggers for reviewing it.

What has to be done anyway

• Sort the fleet by each machine’s handover date; the controller’s year of manufacture is irrelevant for this. The handover date is the reference point for grandfathering, the support period and later retrofits.
• Record the retrofit history per machine: what was converted when, by whom, with which software version? Without that list the substantial-modification question cannot be answered for a single machine.
• Lay down your own position on retrofits as a documented decision, not as an assumption in the head of the engineering manager. Sources, assumptions, review triggers.
• Determine and justify the support period per product: expected lifetime, context of use, availability of components. For the old machines that is not a CRA duty, but the customer asks until when you can still deliver updates all the same.

Where Resilic shortens the path

Resilic is not a legal opinion. It records the facts your decision follows from and keeps them findable:

• The product register carries per product the support period with start, end, expected lifetime and a justified determination signed by a person, and warns when an integrated component reaches end of life before the period ends.
• Custom products carry the handover date as placing on the market: one product per delivered machine, with its own version and its own deployments, instead of an anonymous fleet.
• Deployments show per customer and site which version actually runs; the operator confirms them in the customer portal. Which machine received a retrofit is thus in one place.
• Reporting readiness for the old machines, that is correlation, triage and the reporting cascade, is the same as for new products. Article 69(3) makes no distinction, and neither does Resilic.

What it does not solve

• Resilic does not decide whether a conversion is a substantial modification. The question is legally contested, and software that answered it by rule would give you a certainty that does not exist. A decision record that holds your reading with sources and review triggers is on our roadmap and is not a feature yet.
• Resilic does not set a support period. It requires a justification and a signature; the number comes from you.
• Resilic does not read the Commission’s guidance for you. We quote the Regulation and name what is contested; the interpretation stays with you and your legal counsel.

If your fleet also spans three controller generations: the first practice case describes how a manufacturer with 450 machines in the field becomes able to report. And the free CRA scope check shows in five questions which deadlines apply to you.