The Cyber Resilience Act (CRA) and the new Machinery Regulation (MVO) represent two sets of regulations that are both relevant to many connected machines. For manufacturers, this means that, in addition to safety requirements, cybersecurity, vulnerability management and security-by-design are coming increasingly into focus. Our white paper ‘Cyber Security: CRA and the Machinery Regulation’ outlines which products are affected, where the requirements overlap and what measures companies should be implementing now.
Considering the Machinery Regulation and the Cyber Resilience Act together
For many connected products, it is not the choice between the Machinery Regulation and the CRA that is relevant, but rather the interaction between the two sets of regulations. Whilst the Machinery Regulation focuses on health and safety, the CRA addresses the cybersecurity of digital products throughout their entire life cycle.
Download the report now (in German only)
CE marking: One mark, several obligations
A common misconception is to assume that there are separate CE markings for MVO and CRA. In fact, there is only one CE marking. This confirms that a product meets all applicable European requirements. Manufacturers of networked machinery must therefore check at an early stage which regulatory requirements, in addition to the Machinery Directive, must also be taken into account under the CRA.
Cybersecurity is becoming an ongoing task
With the CRA, the focus is shifting from a one-off conformity assessment to ongoing obligations. Issues such as vulnerability management, security updates, security-by-design, SBOMs and incident reporting are becoming integral parts of product responsibility. For many organisations, this means new organisational processes and closer collaboration between engineering, compliance and cybersecurity.
What businesses should do
Companies should analyse their product portfolio, identify digital components and integrate regulatory requirements into development and lifecycle processes at an early stage. By considering the CRA and the Machinery Directive together, companies not only ensure compliance but also strengthen the resilience of their products and boost the confidence of customers and market supervisory authorities.
Your contact
Andrzej Wozniczka
Partner, Consulting - Cyber Security & Resilience
KPMG AG Wirtschaftsprüfungsgesellschaft