You develop machinery, controllers, components or software and place them on the EU market. With the Cyber Resilience Act and the Machinery Regulation, cybersecurity becomes part of CE marking. Complass guides you per product up to the declaration of conformity.
Report actively exploited vulnerabilities and severe incidents, with an early warning within 24 hours, since 11 September 2026 Art. 14 CRAArticle 14 Cyber Resilience ActReporting obligations of manufacturers1. A manufacturer shall notify any actively exploited vulnerability contained in the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA. The manufacturer shall notify that actively exploited vulnerability via the single reporting platform established pursuant to Article 16. 2. For the purposes of …As of: 06.10.2026 · Source: EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025Open original (EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025) ↗
Develop products according to the requirements of Annex I of the CRA and document the risk assessment Art. 13 CRAArticle 13 Cyber Resilience ActObligations of manufacturers1. When placing a product with digital elements on the market, manufacturers shall ensure that it has been designed, developed and produced in accordance with the essential cybersecurity requirements set out in Part I of Annex I. 2. For the purpose of complying with paragraph 1, manufacturers shall undertake an assessment of the cybersecurity risks associated with a product with digital elements and take the outcome …As of: 06.10.2026 · Source: EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025Open original (EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025) ↗
Handle vulnerabilities throughout the support period, with SBOM and free security updates Anhang I Teil II CRAAnnex I Part II Cyber Resilience ActVulnerability handling requirementsManufacturers of products with digital elements shall: (1) identify and document vulnerabilities and components contained in products with digital elements, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the products; (2) in relation to the risks posed to products with digital elements, address and remediate …As of: 06.10.2026 · Source: EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025Open original (EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025) ↗
Technical documentation, conformity assessment, EU declaration of conformity and CE marking, from 11 December 2027 Art. 71 CRAArticle 71 Cyber Resilience ActEntry into force and application1. This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. 2. This Regulation shall apply from 11 December 2027. However, Article 14 shall apply from 11 September 2026 and Chapter IV (Articles 35 to 51) shall apply from 11 June 2026.As of: 06.10.2026 · Source: EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025Open original (EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025) ↗
Protection against corruption and safety of the control system under the Machinery Regulation, from 20 January 2027 Annex III 1.1.9 MRAnnex III Section 1.1.9 Machinery RegulationProtection against corruptionThe machinery or related product shall be designed and constructed so that the connection to it of another device, via any feature of the connected device itself or via any remote device that communicates with the machinery or related product does not lead to a hazardous situation. A hardware component transmitting signal or data, relevant for connection or access to software that is critical for the compliance of …As of: 06.10.2026 · Source: EUR-Lex – OJ L 165, 29.6.2023; Art. 3, 8, 20, 25a–25e and 47 as consolidated on 27.07.2026Open original (EUR-Lex – OJ L 165, 29.6.2023; Art. 3, 8, 20, 25a–25e and 47 as consolidated on 27.07.2026) ↗
General information, not legal advice. This page summarises the legal position in simplified form and does not replace an assessment of your individual case. The wording of the laws and standards is authoritative.
Sectors and products
Machine and plant engineering Focus area
CRA and Machinery Regulation side by side per machine, from the controller to remote access. The area Complass covers in the greatest depth.
Components, controllers and IoT
PLCs, sensors and connected devices with IEC 62443-4-2 as the basis. Radio products additionally under the Radio Equipment Directive with EN 18031.
Software
Standalone software with digital elements falls under the CRA. Pure cloud services without an associated product are usually governed by NIS2 rather than the CRA.
Connected products and AI
Data access for users of connected products under the Data Act, AI functions in the product under the AI Act.
How Complass helps
CRA per product
Classification as a default, important or critical product, Annex I requirements, conformity assessment and documentation up to CE marking.
Secure product development per IEC 62443-4-1 and component requirements per 62443-4-2, linked with the CRA.
The right package
What you need at a minimum as a manufacturer
The first selection covers the obligations in Complass if they apply to you. The free applicability check shows whether they do. To the applicability check
What you need at a minimum
If you are a manufacturer under the CRA: this selection covers the resulting obligations in Complass. It is preselected when you start a trial or order.
Vulnerabilities and attack techniques (incl. SBOM, CRA product file, MITRE ATT&CK): Handle vulnerabilities and send an early warning on actively exploited vulnerabilities within 24 hours. (Art. 14, Annex I Part II CRA (opens in a new tab))
Incident management: included
GDPR, AI Act and Whistleblower protection (HinSchG) (baseline protection): included
Good to know: You can also meet the obligations without Complass. Complass supports you with implementation and evidence but does not replace legal advice. Legal information
Further packages
For products under the CRA there is the Manufacturers industry template. Manufacturers of medical devices do not fall under the CRA; the medical technology template is intended for them.
available
Industry template: Manufacturers
Cyber Resilience Act per product up to CE marking
Radio Equipment Directive with EN 18031
Vulnerability management with SBOM
from €427 per month plus VAT in the Start package, size S, annual payment
All prices are for businesses, not for consumers. They are net plus VAT with annual payment; monthly payment carries a surcharge of 15 %. As of 16 October 2026. Enterprise and groups of companies on request.
Frequently asked questions
Does our product fall under the CRA?+
The CRA applies to products with digital elements that can be connected directly or indirectly to a device or network. This covers most controllers, connected machines and software. There are exceptions, among others, for products with their own rules, such as medical devices and vehicles. The applicability check and the per-product classification in Complass show which class your product falls into.
How are the CRA and the Machinery Regulation related?+
Both require cybersecurity, from different angles: the CRA for the product with digital elements, the Machinery Regulation for the safe functioning of the machine. You can use many documents, such as the risk assessment and technical documentation, for both. Complass keeps both frameworks side by side per product.
We manufacture and also run our own production. Do we need two solutions?+
No. In Complass you manage your products under the CRA and the Machinery Regulation and your own operation under NIS2, ISO 27001 or IEC 62443 in the same account.
