From 20 January 2027, the Machinery Regulation applies to machinery. For machines that are also products with digital elements, the Cyber Resilience Act obligations apply on top — the reporting obligations from 11 September 2026, the other main obligations from 11 December 2027. One does not replace the other.
Data in the EU · Documents with SHA-256 · Export at any time · No lock-in
All three tools free, no sign-up. Your entries do not leave the browser.
And with the period for which you must keep it. Where both regulations apply, the longer period prevails.
| Document | Legal basis | Retention |
|---|---|---|
| Technical documentation | Art. 10(2) · Annex IV A | at least 10 years |
| Risk assessment | Art. 8 · Annex III | with the file |
| Source code of safety-relevant software | Annex IV A m | on reasoned request |
| Instructions, digital permitted | Art. 10(7) | online at least 10 years, paper on request within 1 month |
| EU declaration of incorporation, partly completed machinery | Art. 22 · Annex V B | at least 10 years |
| Assembly instructions | Art. 11(7) · Annex XI | online at least 10 years |
| Technical documentation (CRA) | Art. 31 · Annex VII | 10 years or support period, whichever is longer |
| Cybersecurity risk assessment | Art. 13(2–4) | kept up to date continuously |
| Software bill of materials (SBOM) | Annex I II(1) | not public; in the file on reasoned request |
| Support period and its justification | Art. 13(8) and 19 | at least 5 years, longer in plant construction |
| Archive of security updates | Art. 13(9) | at least 10 years from release |
| Report: 24 h / 72 h / 14 days | Art. 14 | Incident register |
| One EU declaration of conformity for all acts | Art. 21(3) · Art. 28(3) | online at least 10 years |
| CE marking, cumulative | Art. 24 · Art. 30(5) | — |
The order is not freely chosen: the risk assessment comes before the protective measures, the protective measures before the instructions, and the declaration only after the conformity assessment. A risk assessment drawn up afterwards does not meet the requirements.
Placing on the market does not end the conformity work — obligations remain even after the Machinery Regulation, for example on series conformity and corrective measures. The Cyber Resilience Act, however, adds an explicitly ongoing process: vulnerabilities are handled throughout the entire support period, and the technical documentation must be kept up to date at least that long. As a rule at least five years – shorter only if the expected period of use is shorter; longer in machinery and plant construction.
It is precisely this cycle that makes the difference between a file you create once and one you keep.
The Machinery Regulation names cybersecurity in two places. The Cyber Resilience Act, in its recital 53, names exactly those same two places.
The machine must be designed and built so that the connection of another device — through a function of the connected device itself or via a remote-access device communicating with the machine — does not lead to a hazardous situation. Anyone holding a cybersecurity certification under Regulation (EU) 2019/881 is presumed to conform with this point.
Control systems must withstand intended and unintended external influences, including reasonably foreseeable malicious attempts by third parties. Versions of the safety software must be kept traceable for five years; for self-evolving systems, decision data is added, for one year.
The synergy between the two regulations does not arise on its own. It must be demonstrated by the manufacturer — through a risk assessment that also covers the cybersecurity risks.
Recital 53 of Regulation (EU) 2024/2847
No account, no email address, no trial period. You compute in the browser and take the result with you.
A declaration that names both regulations — with the references of their publication, as the article requires.
First the question that comes before the deadline: actively exploited vulnerability or serious incident? The deadlines run differently.
Upload your current declaration: within seconds you see what no longer fits from 20 January 2027.
No demo, no sales call, no minimum term.
All three tools are free to use, and the paid conformity file is available now. Sign up if you want to be informed about changes to the two regulations.
Tools — available from today
0 €
The three tools, free permanently.
File
49 € / month
One product file, kept alive. One register, two regulations.
File extended
119 € / month
Up to five products.
For larger volumes: Team (up to 10 products) €199 / month, Professional (up to 20 products) €299 / month — available in your account.
Annual payment 20 % cheaper. Micro and small enterprises may submit the technical documentation in simplified form under Art. 33(5) CRA; the file supports both formats.
All article and annex references on this page are taken from the versions published in the Official Journal: Regulation (EU) 2023/1230, OJ L 165, 29.6.2023, and Regulation (EU) 2024/2847, OJ L, 2024/2847, 20.11.2024.
The annexes of both regulations are checked against the versions published in the Official Journal. The details on these pages are paraphrased and shortened; the official wording prevails.
normakte is a drafting and calculation aid. It replaces neither the conformity assessment, nor a notified body, nor legal advice.