Industrial controllers and PLCs under the CRA

The classification

Programmable logic controllers are not expressly listed in Annex III or IV; they therefore generally fall into the default category with internal control. It may be different if the core functionality corresponds to a category listed there. Check the classification case by case.

What matters in practice

Controllers often stay in use for ten years and more: the support period must reflect this, and security updates must be installable in running plants. The SBOM covers operating system, runtime and libraries; the engineering software may itself be a product with digital elements.

Controllers in machines

If the controller is part of a machine, both the Machinery Regulation and the CRA apply to the machine. The requirements on protection against corruption and on safety and reliability of control systems in Annex III of the Machinery Regulation overlap with the CRA cybersecurity requirements; Recital 53 requires these synergies to be demonstrated.