EU Cyber Resilience Act Enforced Amid Machinery Regulation Changes

• •The Cyber Resilience Act mandates cybersecurity for digital products in the EU market.
• •Manufacturers must report exploited vulnerabilities to ENISA within 24 hours.
• •The Machinery Regulation introduces new compliance requirements for connected machinery.

On September 10, 2026, the EU began implementing the Cyber Resilience Act (CRA), which mandates cybersecurity requirements for products with digital elements. This regulation affects manufacturers and importers of machinery, including connected systems. The CRA requires products to be designed with cybersecurity in mind, ensuring no known exploitable vulnerabilities at market entry. Manufacturers must also handle vulnerabilities responsibly and report actively exploited ones to ENISA within 24 hours. The Machinery Regulation (EU) 2023/1230, which focuses on digital and AI-enabled machinery, complements the CRA and will be fully applicable by January 20, 2027. These regulations aim to enhance the overall cybersecurity posture within the EU market and address rising cyber threats. The CRA's obligations include maintaining processes for coordinated vulnerability disclosure and providing digital documentation for compliance. The changes are expected to influence future equipment purchases and IT security strategies across various sectors.