Worked example: Brannvik SprayLine M24
A fictional manufacturer and a fictional tractor-mounted field sprayer with an ISOBUS connection, an LTE telematics gateway and a Bluetooth app. All 14 templates are filled in: 25 completed files.
Applicability: interchangeable equipment, in scope, no notified body, CRA applies too
Interface analysis: which command each interface may give
Protection specification: testable requirements, each traced to a measure and a test
Update procedure: download in the background, activate only at standstill after confirmation
Instructions for use: the cybersecurity chapter as published, with release notes
Substantial modification: four changes assessed, one turned down
Six lessons from the example
A tractor implement is still machinery
The sprayer is interchangeable equipment. Tractors are excluded from the Regulation, but machinery mounted on them is not. It is not listed in Annex I, so no notified body is needed.
Compliance-critical is wider than safety software
The rate control that keeps spraying within section 2.4 is critical too, and so are the gateway, the app and the cloud service, because each can write values that control spraying.
Let the controller decide
The SLC-3 controller decides which command it accepts from which interface. The gateway, the app and the cloud cannot start or move anything, which removes most remote hazards by design.
Every document finds a gap in the one before
The protection specification found no measure against accidental corruption of stored data. The update procedure found that no document said when an update may be activated. Both were fixed upstream.
Supplier support can end sooner than yours
The gateway module supplier provides security updates for its board support package until the end of 2032, shorter than Brannvik's ten-year support period. A successor module is planned and assessed in advance.
One machine, more than one law
The LTE and Bluetooth module makes the Radio Equipment Directive apply, and the CRA applies to the same product. The CRA's opt-out from automatic updates was added to the update procedure.
Reading the example correctly
The evidence matrix. The matrix lists 40 obligations from Annex III and the related articles, and shows for each one the measures, requirements, logged events and tests that support it. Its count measures how complete the evidence is. It is not a conformity decision, and Brannvik still signs the EU declaration of conformity on its own responsibility.
Substantial modification. Four changes are assessed against the conditions of Article 3(16) and against the CRA (Art. 3(30)): a security fix, a successor gateway module, a proposed app feature that would fold the boom from a phone, and a dealer replacing a controller. Only the app feature is substantial, and it was turned down for the M24. The successor module is not substantial on two conditions, both verifiable.
Dates. The documents are dated from November 2026 to January 2027, ahead of the planned placing on the market on 1 March 2027. Because that date is after 20 January 2027, the M24 is placed on the market under the Regulation, not under Directive 2006/42/EC.
The 25 filled example files come with the full kit.
Brannvik Agri Systems AB and all people, documents and cases in the example are fictional.