The EU Cyber Resilience Act (CRA) and the new Machinery Regulation impose stringent requirements on machinery and equipment manufacturers regarding reporting, device cybersecurity and documentation. Manufacturers must ensure that their processes and supply chains are ready in time, as the deadlines are rapidly approaching. Although artificial intelligence can speed up assessments, ultimate responsibility for equipment safety always remains with people.
Machinery and equipment manufacturers now have several fixed dates in their calendars. The first has already passed: the CRA’s vulnerability reporting obligations came into force on 11 September 2026. These obligations also apply to products already on the market.
The next milestone is 20 January 2027, when the Machinery Directive will be replaced by the Machinery Regulation (EU) 2023/1230. The Regulation will apply directly in all EU Member States.
Antti Laatikainen, Gofore’s Lead Cybersecurity Advisor, points out that the regulations largely serve the same purpose. He has worked as a cybersecurity consultant for more than a decade, particularly in critical infrastructure and manufacturing, and previously participated in an EU working group developing a standard for vulnerability management under the CRA.
According to Laatikainen, companies in the sector vary considerably in their readiness to meet regulatory requirements.
“Manufacturers are familiar with regulations relating to quality and physical safety, but cybersecurity still causes confusion for many. What is standard practice in IT companies requires manufacturers to learn new ways of working. Documentation is not up to date, and processes are still being developed. However, some organisations are already in a good position,” Laatikainen explains.
CRA requirements and reporting obligations extend to the cloud
Reporting requires clear processes and designated individuals responsible for notifying authorities of serious incidents. However, the work does not end there. Laatikainen points out that the obligations extend much further.
Manufacturers must also understand the backend systems their devices connect to, such as their own cloud services. If a device depends on a backend system to function, or if confidential information is processed within that system, cybersecurity incidents affecting it must be reported.
“It is not enough to have the right names on the reporting list. You need to understand your own environment well enough to know exactly what needs to be monitored and to be able to monitor it effectively.”
This changes how responsibilities are allocated. Even if a system runs in a public cloud, the cloud provider does not monitor it on the manufacturer’s behalf. If someone gains unauthorised access to the system or tampers with it, detecting and reporting the incident is entirely the manufacturer’s responsibility.
Machinery Regulation requirements: every protective measure must be justified
The new Machinery Regulation further increases the need for documentation and requires machinery safety and relevant standards to be considered from the outset. Unlike the previous Machinery Directive, the Regulation requires every protective measure to be justified: manufacturers must be able to demonstrate which specific health or safety requirement each measure addresses.
At the same time, risks associated with a machine’s self-learning logic and behaviour must be assessed. Safety-related software must be documented in the technical documentation, including source code and update procedures.
Laatikainen believes that self-learning machinery is entirely acceptable, provided that humans remain in control.
“AI is just a tool, like an extremely complex calculator. It does not take responsibility for a company’s business risks or people’s safety. If a safety-critical function is left to AI, responsibility has been assigned incorrectly.”
A system can optimise its operations on a weekly basis, for example, provided there is a clear approval stage between updates. A person must follow an established protocol to review what the system has learnt, how it responds and whether it remains safe.
The EU regulations have a clear division of responsibilities. The Machinery Regulation ensures that machinery can be used safely.
“Broadly speaking, it is about making sure that people operating machinery keep their fingers intact,” Laatikainen summarises.
The CRA, meanwhile, aims to prevent devices from being hijacked or manipulated without authorisation. Its scope covers everything from a municipal water pump to a toaster that sends a notification to your phone when your toast is ready.
EU Machinery Regulation 2027 and the CRA: most of the work is the same
The CRA, the new Machinery Regulation, NIS2 and GDPR overlap in many areas. If a company launches a separate project for every individual regulatory requirement, the workload will quickly become overwhelming.
“The big ‘secret’ is that around 85 per cent of the requirements are essentially the same: high-quality, secure software development practices and good cybersecurity management.”
Laatikainen divides the work into four themes that cover the different regulations:
- Know what you are building. Secure design, up-to-date documentation, change management, threat modelling and management approval.
- Know what your product contains. Vulnerability and lifecycle management. One new requirement introduced by the CRA is that manufacturers are responsible for providing security updates throughout a device’s support period.
- Prepare for incidents. Logging, monitoring, clear responsibilities, incident response, crisis management and recovery plans, and regular exercises to test them.
- Know your supply chain. No organisation can manage everything alone. A dependency might be a factory maintenance contract or a software library with a vulnerability that requires urgent patching.
“What happens within a few hours or a couple of days if a supplier can no longer deliver a spare part or operate a cloud service? What if data is lost?”
AI speeds up assessments, but responsibility remains with people
The speed of documentation work largely depends on the organisation’s internal IT and cybersecurity expertise. AI can be a valuable tool alongside these capabilities.
Large language models can review materials in moments and identify inconsistencies and overlaps. They are familiar with industry standards and can highlight gaps in secure software development guidelines.
Laatikainen therefore recommends giving AI as much precise background information as possible, for example:
“You are my colleague, and we are developing our company’s CRA capabilities. First, explain what the CRA requires of guidelines like these, and then check whether these guidelines meet the requirements.”
However, there are two important considerations when using AI. First, organisations must carefully consider what material they provide to AI and which service they use.
If documents contain trade secrets or critical security information, it is important to think carefully about which service, if any, they should be uploaded to. In such cases, it is better to use AI for general discussion and carry out the final comparison independently.
Second, any text generated by AI should always be treated as a rough draft.
“Responsibility cannot be outsourced to AI. Every piece of text needs a human owner. AI-generated content should be treated like a colleague’s first draft: very few initial drafts become official company policy without further work.”
AI cannot change company culture or implement new practices either. It can quickly create a framework, but changing ways of working and securing team commitment always remain human responsibilities.
The essential task is to determine which AI-assisted approaches are suitable for the organisation and how they can be integrated into the everyday work of software developers and production lines. According to Laatikainen, external support can save both time and money in this process.
You cannot add quality to a finished medicine bottle
At Gofore, cybersecurity is seen as a comprehensive organisational responsibility rather than a separate IT project. Laatikainen illustrates this through his experience in the pharmaceutical industry, where he previously oversaw cybersecurity across the production chain for ophthalmic medicines.
“Of course, we had quality assurance, but everyone understood that you cannot pour quality into a finished medicine bottle sitting on a table. Quality is created through everyday practices across the entire chain, from forklift drivers to ventilation systems.”
In a similar way, the CRA makes cybersecurity a shared responsibility across the entire organisation. A single cybersecurity specialist cannot carry that responsibility alone.
This is why guidelines should be developed one function at a time. In practice, this means bringing software developers, logistics teams and procurement departments together in turn.
“When employees can contribute to the guidelines themselves, their commitment and motivation to follow them are on a completely different level.”
Warning signs that your organisation is already behind
Every machinery and equipment manufacturer should be able to answer the following questions today:
- Who in our organisation receives reports of cybersecurity incidents? Do our customers know how and where to report vulnerabilities in our products?
- Where can we find the authority’s portal for submitting reports?
- Which backend IT systems do our products depend on to function?
- Can we detect disruptions in these systems, monitor them and respond quickly?
- Have specific individuals or teams been assigned responsibility for maintaining and monitoring these systems?
“If any of these questions leave you uncertain, it is time to act quickly. These are already serious enough business risks that companies cannot afford to sit around wondering what to do.”
Although companies have until December 2027 to meet the CRA’s final requirements, Laatikainen recommends addressing high-level policies immediately. If a company lacks an information security policy defining who is responsible for security, how it is developed and what responsibilities teams and individuals have, the work should begin now.
There is another side to regulation, too. CRA compliance is a prerequisite for being allowed to sell a product in the EU.
If the requirements are not met, a product may be withdrawn from the market, and significant penalties may follow. Authorities also carry out spot checks and product audits on products available on the market.
Start with a cup of coffee
So where should organisations begin? According to Laatikainen, at grassroots level.
In the past, a carpenter might have kept drawings on the back of a cigarette packet in their pocket. Today, software developers have their own notes, electricians have their drawings, and IT professionals hold knowledge about update procedures.
“Grab a cup of coffee and talk to the people who actually do the work. Simply ask: what do we already have in place?”
Laatikainen compares cybersecurity to seat belts. When they were first introduced, they seemed like an unnecessary burden. Today, nobody advertises a car by highlighting its seat belts because they are simply taken for granted.
IT companies already prominently display their information security certifications on their websites, and manufacturers would benefit from adopting a similar approach to differentiation.
“The aim should not be to scrape through just before the deadline. Companies should strive to become the most trusted operators in their industry. When they achieve that, regulatory deadlines become little more than a side issue.”
Would you like to assess your organisation’s readiness for the CRA requirements and the new Machinery Regulation? Gofore’s experts can help assess your current situation and plan the necessary next steps.
Key dates for the CRA and the Machinery Regulation
- 11 September 2026 – CRA: Vulnerability reporting obligations begin. These also apply to products already on the market.
- 20 January 2027 – Machinery Regulation: New machinery must comply with the new Regulation instead of the Directive. There is no transition period: the Directive applies until 19 January 2027, and the Regulation applies from 20 January onwards.
- 11 December 2027 – CRA: Essential cybersecurity requirements come into force for new products placed on the market.
