A machine with a network connection, a radio or an app is usually two things in EU law: machinery under Regulation (EU) 2023/1230, and a product with digital elements under the Cyber Resilience Act, Regulation (EU) 2024/2847. Both apply in parallel. Meeting one does not show that you meet the other.
Dates side by side
| Date | What applies |
|---|---|
| 11 September 2026 | CRA reporting duties for actively exploited vulnerabilities and severe incidents |
| 20 January 2027 | Machinery Regulation, including Annex III 1.1.9 and 1.2.1 |
| 11 December 2027 | CRA in full. The same day the cybersecurity requirements under the Radio Equipment Directive for internet-connected radio equipment stop applying |
So a connected machine faces CRA reporting before the Machinery Regulation applies, and the full CRA eleven months after it.
Different aims
The Machinery Regulation protects people from hazards. Its cybersecurity measures are limited to what protects the safety of the product (recital 25). The CRA protects the product, its data and the networks it connects to: confidentiality, integrity, availability, vulnerability handling and security updates for the support period.
CRA recital 53 puts the relationship plainly: machinery that is a product with digital elements must meet both sets of essential requirements. Meeting the CRA can make it easier to meet 1.1.9 and 1.2.1, but the manufacturer must show the overlap, and both conformity procedures apply. On the machinery side the only presumption for 1.1.9 and 1.2.1 comes from a certificate or statement of conformity under a cybersecurity certification scheme of Regulation (EU) 2019/881, as far as it covers them (Art. 20(9)).
Where they overlap
Much of the work serves both: a risk assessment that covers threat scenarios, secure boot and signed updates, authenticated interfaces, a reduced attack surface, protection of integrity. One requirement, one test and one piece of evidence can count for both regulations if your documents say so.
Where they pull apart
| Topic | CRA | Machinery Regulation | A defensible position |
|---|---|---|---|
| Updates | Automatic updates by default, with opt-out | No hazard from a remote device; safety software changes logged | Automatic download, activation only in a safe state with operator confirmation |
| Monitoring | Users can opt out of monitoring | Evidence of interventions cannot depend on the user | No opt-out for the evidence log; opt-out for other data |
| Deletion | Users can remove data and settings | Tracing log kept five years after each upload | Users delete pairings, settings and statistics; the evidence log stays |
| Availability | Essential functions stay available | Safety first | Where a safety function needs it, the safe stop wins |
Decide each tension once, in writing, and refer every document that relies on it to that decision.
One file, one declaration
Where several acts require technical documentation, the CRA allows one set (CRA Art. 31(3)). The Machinery Regulation asks for a single EU declaration of conformity covering all acts that apply (Art. 21(3)). Build one risk assessment, one technical file with a cybersecurity part that serves both, and one declaration that names both regulations.
A map that reads both ways
The practical tool is a two-way map: every CRA requirement against the machinery obligations it meets, and every machinery obligation back. A link that exists in only one direction is usually a mistake. The rows that stay empty on one side are your gaps.
This article explains Regulation (EU) 2023/1230 and Regulation (EU) 2024/2847 in plain words. It is not legal advice.