Updated 14 October 2026
The EU Cyber Resilience Act (CRA) sets mandatory cybersecurity requirements for products with digital elements placed on the EU market. Most machines with control software fall under it, because the CRA covers products with a direct or indirect data connection to a device or network. If you place a machine on the EU market under your name, you are its manufacturer under the CRA, and that includes the software you integrate: PLC programs, libraries and other digital components.
Two dates
- Since 11 September 2026: Manufacturers must report actively exploited vulnerabilities and severe security incidents. This also applies to machines already on the market.
- From 11 December 2027: All other requirements apply to every machine you place on the market from that date, unit by unit, even if the design is older. This includes the conformity assessment, the EU declaration of conformity, the CE marking and the technical documentation. Machines placed on the market before that date are covered only if they are substantially modified afterwards.
What the CRA requires from the manufacturer
Secure development and a risk assessment. The manufacturer assesses the cybersecurity risks of the product and takes them into account from design to maintenance. For components from third parties, such as libraries in the PLC program, the manufacturer must exercise due diligence so that they do not compromise the security of the machine.
A software bill of materials (SBOM). The manufacturer identifies the components contained in the product and documents them in an SBOM in a commonly used, machine-readable format, covering at least the top-level dependencies. CycloneDX and SPDX are the common formats.
Vulnerability handling over a support period. The manufacturer sets a support period, generally at least five years, and states its end date. During this period, it handles vulnerabilities and provides security updates without delay and, unless otherwise agreed with a business customer for a tailor-made product, free of charge. It discloses fixed vulnerabilities, needs a policy for coordinated vulnerability disclosure and a contact point where vulnerabilities can be reported.
Reporting. Actively exploited vulnerabilities and severe incidents are reported through the ENISA Single Reporting Platform: an early warning within 24 hours of becoming aware, a notification within 72 hours and a final report. Affected users are informed about the issue and the remedy.
Who gets what
| For the market surveillance authority | For your customers |
|---|---|
| Technical documentation, kept available for at least ten years after placing on the market, or for the support period if longer, and provided on request. It includes: product description, design and architecture, risk assessment, vulnerability handling including the SBOM, test reports, EU declaration of conformity | Information and instructions for safe use, including: manufacturer contact, contact point for vulnerabilities, intended purpose and security properties, end of the support period, how to install security updates, where to find the EU declaration of conformity |
| The SBOM itself on reasoned request | If you choose to make the SBOM available: where users can access it |
The CRA does not require you to hand the SBOM or the risk assessment to your customers. In practice, customers may ask for them in their purchasing conditions, and you will want similar evidence from your own suppliers. It helps to have both in a form you can share, for example under an NDA or as a summary that does not expose details an attacker could use.
In short
Now, since 11 September 2026:
- Send an early warning on actively exploited vulnerabilities and severe incidents within 24 hours of becoming aware.
From 11 December 2027, for every machine you place on the market:
- Assess the cybersecurity risks of the machine, including third-party components.
- Draw up an SBOM in a machine-readable format and keep it current when the components change.
- Set and communicate a support period; provide security updates during it.
- Publish a contact point for vulnerabilities and a coordinated vulnerability disclosure policy.
- Keep the technical documentation for at least ten years, or for the support period if longer, and provide user information with the machine.
- Complete the conformity assessment, sign the EU declaration of conformity and affix the CE marking.
Where DDAS helps
The DDAS CRA Compliance Service analyzes your CODESYS project. You receive an SBOM with every library in your PLC program, a risk analysis at code and library level as input to your own risk assessment, and a check of your CODESYS components against the security advisories published by CODESYS at the time of the analysis, delivered as a signed handover package. As an option, booked together with an analysis run, you prepare the classification paper and a draft of the EU declaration of conformity with our guided wizards. The assessment and the signature stay with you.
This covers part of the technical documentation, not all of it. Firmware, operating system and HMI are outside the scope, as are the user information and your own vulnerability handling process.
This article is general information, not legal advice.