normakte / Cybersecurity
Two points of Annex III, and a recital of the Cyber Resilience Act that points exactly at them. Whoever must meet both regulations saves here — but only with proof.
From 20 January 2027, a connected machine falls under the Machinery Regulation. If it is also a product with digital elements, the Cyber Resilience Act applies in addition. One does not replace the other.
Manufacturers of products falling under Regulation (EU) 2023/1230 that are also products with digital elements must meet both the essential cybersecurity requirements of that regulation and the health and safety requirements of Regulation (EU) 2023/1230.
Recital 53 of Regulation (EU) 2024/2847
| Requirement | Content | Basis |
|---|---|---|
| Protection against corruption | Connecting another device to the machine — directly or via remote access — must not lead to a hazardous situation | Annex III 1.1.9 |
| Safety and reliability of control systems | Control systems must withstand intended and unintended external influences, including reasonably foreseeable malicious attempts by third parties; a traceable log is added, accessible for five years on reasoned request | Annex III 1.2.1 |
Machines certified, or for which a declaration of conformity has been issued, under a scheme adopted pursuant to Regulation (EU) 2019/881 are presumed to conform with these two precise requirements — to the extent the certificate covers them (Art. 20(9)).
Recital 53 continues: CRA conformity can make it easier to demonstrate the machinery requirements 1.1.9 and 1.2.1. Then comes the sentence that creates the work: such synergies must be demonstrated by the manufacturer — for example through a risk assessment covering these cybersecurity risks. The manufacturer also follows the conformity assessment procedures of both regulations. The saving is therefore real, but not automatic: it arises from a document that maps each CRA requirement to the corresponding Annex III requirement. Separate documentation is permitted; a common requirements matrix considerably eases the traceable proof.
One product, many requirement lines — each with its regulation, its article and its evidence. Two legal bases, one traceable chain of evidence. Each line needs three states, not two: met, not applicable with justification, or otherwise mitigated — because Art. 13(4) CRA requires a clear justification in the documentation where a requirement is not applicable.
Register of all Machinery Regulation requirements, documents with checksum, declaration and nameplate with QR code – one trial file free until 20.01.2027.
Sources. References from the versions published in the OJ: Regulation (EU) 2023/1230; Regulation (EU) 2024/2847. The official text prevails; normakte is a drafting aid, not legal advice.