Who reports when the machine is yours and the inspection is your partner’s?

The third practice case is about roles. Hardly any line today comes from a single source, and the CRA distributes its duties along the question of who places what on the market. Again five fixed sections, again with the section on what Resilic does not solve. Here it is particularly short.

The situation

A packaging line for a food manufacturer: the base machine from you, the camera inspection from a partner company as its own module, controller and drives from two suppliers, commissioning at the customer by your service team. The line has been running since 2023. On a Tuesday, CISA’s KEV catalogue lists an actively-exploited vulnerability in the inspection camera’s firmware. Your customer reads it in the trade press and calls you, not the partner. Who reports now, by when, and to whom?

What the law requires

The CRA ties the manufacturer role to the product that is placed on the market. Under Article 3(1), a component with digital elements placed on the market separately is itself a product with digital elements; its supplier is a manufacturer with its own, full obligations. For the line this means:

• The camera manufacturer is the manufacturer of the camera and its firmware. The actively-exploited vulnerability in that firmware is first its report under Article 14, for its product.
• The partner that delivers the inspection module as its own product is the manufacturer of that module, including its own software and integration. If the vulnerability affects its module and is exploited there, it reports for its module.
• You are the manufacturer of the line you placed on the market — including your PLC application, the HMI project and the integration. If the vulnerability affects your product and is actively exploited, you report for your product, on the same 24-hour, 72-hour and final-report cascade. And you inform your users under Article 14(8). The customer did not call you for nothing.
• Purely mechanical parts are outside the scope. Spare parts are exempt only if they replace identical components to the same specification (Article 2(6)); an improved replacement part is not.
• Whoever places components of a manufacturer established outside the EU on the market under that manufacturer’s name is an importer (Article 3(16)), with duties of its own that are often overlooked when buying in cameras and industrial PCs.

From 11 December 2027 the due-diligence duty under Article 13(5) and (6) is added: when integrating third-party components you verify that they do not compromise the cybersecurity of your product, and you report a vulnerability identified in a component to its manufacturer. And from 20 January 2027 the Machinery Regulation (EU) 2023/1230 applies to the line as a machine, with cybersecurity as an essential health and safety requirement: protection against corruption (Annex III point 1.1.9), control systems that withstand reasonably foreseeable malicious attempts (1.2.1), and the tracing log (1.2.1(f)). The manufacturer of the machine within the meaning of the Machinery Regulation is whoever places the line as a whole on the market, in this case you.

What has to be done anyway

• A supplier directory with the contact point for security notifications per supplier and partner: the PSIRT or advisory channel, not the sales address.
• Agree contractually who informs whom within which deadline: the camera manufacturer the partner, the partner you, you the customer. A 24-hour window leaves no time to negotiate that on the day.
• Record your own role per component (manufacturer, importer or distributor) and document which parts are outside the scope and why.
• Keep the line’s documentation so that it is reusable in 2027 for the Machinery Regulation and for the technical documentation under the CRA: which software, which version, which access.

Where Resilic shortens the path

• The supplier directory with a file per supplier: identity, PSIRT and advisory channel, declared support commitments, declared conformity status and the qualification status your organisation sets and signs itself.
• The software bill of materials per version names the supplier per component; the correlation against EUVD, NVD and KEV shows which component of which manufacturer is affected and which deployments at which customers contain it.
• The reportable event carries the affected deployments and the reporting cascade for your product; the CSAF security advisories with customer notification document that you informed your users.
• The dual-compliance view maps your Annex I register against the Machinery Regulation, and the evidence pack collects per product what an assessor wants to see: one evidence base for both regulations.

What it does not solve

• Resilic does not determine your role. Who is manufacturer, importer or distributor follows from contracts and supply routes. That is a legal question per case that you settle with your legal counsel.
• Resilic does not report for the partner and takes over no duty of the camera manufacturer. Everyone reports for their product; Resilic helps you with yours.
• Resilic does not replace a contractual chain of information. It records whom you informed when. Whether the partner informs you in time is governed by your contract.

If your lines also come from several hands: the "Modelling machines" page in our documentation describes who is the manufacturer of what and what belongs in the machine’s bill of materials. And the free CRA scope check shows in five questions which deadlines apply to you.