Who it’s for
You manufacture in your own plants, build machinery or components and supply customers who ask for evidence. This brings several frameworks into play at once: NIS2 for your company, the CRA and the Machinery Regulation for your products. Complass brings both together in one account, from the shop floor to CE marking.
NIS2 already applies, the CRA reporting obligations since 11 September 2026, the Machinery Regulation from 20 January 2027. Each framework has its own deadlines, evidence and owners.
Controllers from several decades, remote maintenance by vendors and integrators, firmware without support: many plants lack a complete OT inventory.
Security questionnaires from customers arrive ever more often, and the answers are scattered across Excel lists, folders and people’s heads.
Machine building is listed in Annex 2 of the German BSI Act. From medium size onwards you are therefore an important entity under NIS2, with these obligations:
Frameworks: NIS2 · IEC 62443 · ISO 27001 · Machinery Regulation · CRA · TISAX
Not sure which frameworks apply to you? Start the applicability check
Costs, effort and time: consultant only, consultant with Complass or in-house with Complass? Open the compliance cost calculator
Own products. The page for manufacturers shows what obligations the CRA and the Machinery Regulation bring per product, from classification to the declaration of conformity. Go to the page for manufacturers
General information, not legal advice. This page summarises the legal position in simplified form and does not replace an assessment of your individual case. The wording of the laws and standards is authoritative.
Every plant is a project of its own: zone model and remote maintenance per customer plant, plus your own works under NIS2.
Product families with a shared SBOM and vulnerability handling throughout the support period.
Chemicals, food and plastics with process control systems: asset inventory, zones and business continuity for production outages.
ISO 27001 as the basis for customer evidence, plus preparation for the TISAX assessment along the VDA ISA.
Capture controllers, drives, operator panels and network components from network captures in the browser, with vendor, firmware and end of support.
More about this featureDivide your production into zones per IEC 62443-3-2, document connections and remote access as conduits and set security levels.
More about this featureFind known vulnerabilities of your components and rank them by whether they are actively exploited and how exposed the plant is.
More about this featureAnswer your customers’ questionnaires from what you already have and invite suppliers to a self-assessment.
More about this feature
Two industry templates cover the typical tasks in machine building: one for your own production, one for your own products. They can be combined. For automotive suppliers, TISAX can be added as a framework of its own.
available
from €526 per month plus VAT in the Start package, size S, annual payment
available
from €427 per month plus VAT in the Start package, size S, annual payment
available
from €179 per month plus VAT in the Start package, size S, annual payment
All prices are for businesses, not for consumers. They are net plus VAT with annual payment; monthly payment carries a surcharge of 15 %. As of 16 October 2026. Enterprise and groups of companies on request.
If you manufacture machinery and are at least medium-sized, usually yes, as an important entity. What counts is your main activity, the number of employees and turnover and balance sheet total. The applicability check tests this in a few minutes.
ISO 27001 is the usual framework for office IT and the management system, IEC 62443 for production and plants. Many industrial companies use both. In Complass you link the requirements so that you document a measure only once.
Yes. Your measures, evidence and documents are kept in one place and can be prepared for customers as Excel or PDF. This way you answer recurring questions from what you already have.
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.
