- 11 Sep 2026
- CRA reporting of actively exploited vulnerabilities and severe incidents begins
- 20 Jan 2027
- Machinery Regulation (EU) 2023/1230 applies, replacing the Machinery Directive
- 11 Dec 2027
- Most CRA obligations apply, including security-by-design requirements and support periods
Who this affects
- Robot makers selling robots, controllers or robot software in the EU. US companies are covered when they sell there.
- Importers and distributors that sell a product under their own name, or substantially modify it, and so become its manufacturer.
- Integrators that build robot cells and place them on the EU market as machinery.
- US end users aren't directly regulated, but should expect EU-linked customers, suppliers and insurers to ask the same security questions.
Cyber Resilience Act
The CRA covers "products with digital elements" placed on the EU market that connect, directly or indirectly, to another device or network. Most robots, robot controllers, fleet managers and robot software fall within it.
Reporting, in force since 11 September 2026
| Report | Deadline |
|---|---|
| Early warning | Within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident |
| Notification | Within 72 hours |
| Final report: exploited vulnerability | No later than 14 days after a fix or mitigation is available |
| Final report: severe incident | Within one month of the notification |
Reports go at the same time to the national CSIRT and to ENISA through its Single Reporting Platform.
Product requirements, from 11 December 2027
- A secure default configuration, with no known exploitable vulnerabilities at release
- Protection against unauthorized access, including authentication and access control
- A vulnerability handling process, including a public way to report vulnerabilities
- Free security updates for the support period, which generally must be at least five years unless the product is expected to be used for less
- A software bill of materials (SBOM) and technical documentation
- CE marking that covers cybersecurity
Machinery Regulation (EU) 2023/1230
The Machinery Regulation replaces the Machinery Directive from 20 January 2027. Its essential health and safety requirements (Annex III, sections 1.1.9 and 1.2.1) require machinery to be protected against accidental or intentional corruption that could lead to hazardous situations, and control systems to be designed so that malicious attempts don't make the machine unsafe. Safety-relevant software and data must be identified and protected, and interventions must be traceable.
In practice, a robot cell's risk assessment now has to consider network attacks that could change safety-related behavior.
How the standards fit
| Standard | Role |
|---|---|
| IEC 62443-4-1 | Secure product development lifecycle for component makers |
| IEC 62443-4-2 | Technical security requirements for components such as robot controllers |
| IEC 62443-3-3 | System security requirements, used by integrators for robot cells |
| ISO 10218-1 and -2 (2025) | Robot safety standards that now include cybersecurity requirements as they apply to safety |
Harmonised standards for the CRA are still being developed. Until they're published, IEC 62443 is the most common foundation robot makers use to show security by design.
How to prepare
- Inventory. List every product and software version you sell in the EU, and decide which are in scope.
- Vulnerability intake. Publish a reporting address and a security.txt file, and set up a triage process.
- 24-hour workflow. Decide now who confirms an exploited vulnerability, who files with ENISA and what information they need.
- SBOM. Produce a software bill of materials for each product and keep it current.
- Support period. Define the support period for each product and how updates will be delivered.
- Secure defaults. Ship with unused services off, no default passwords and authenticated interfaces.
- Risk assessment. Add network attack scenarios to machinery risk assessments.
- Gap analysis. Compare your development process and products against IEC 62443-4-1 and 4-2, and close gaps before December 2027.
How we help
We test robot products and cells against IEC 62443 and the CRA's requirements, help set up vulnerability handling and the 24-hour reporting workflow, and support incident response when a report clock is running. See robot exposure assessment and incident response.
Common questions
Does the Cyber Resilience Act apply to US robot makers?
Yes, when they place products with digital elements on the EU market. The CRA applies to any manufacturer selling there, wherever it is based.
When does CRA vulnerability reporting start?
Reporting obligations have applied since 11 September 2026. Manufacturers must send an early warning within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident.
When does the EU Machinery Regulation apply?
From 20 January 2027, when it replaces the Machinery Directive 2006/42/EC.
Do robot integrators have obligations?
Integrators that place machinery such as robot cells on the EU market must meet the Machinery Regulation. An integrator that substantially modifies a product with digital elements may also become its manufacturer under the CRA.
Robot cell acting up?
24/7 robot incident line: 646-560-5083. Not urgent? Book an exposure assessment and an engineer replies within one business day.