For manufacturers

What lies ahead

The obligations apply per product and over the entire support period. The main points with their dates:

Frameworks: CRA · Machinery Regulation · IEC 62443 for manufacturers · Radio Equipment Directive · Data Act · AI Act

Report actively exploited vulnerabilities and severe incidents, with an early warning within 24 hours, since 11 September 2026 Art. 14 CRA
Develop products according to the requirements of Annex I of the CRA and document the risk assessment Art. 13 CRA
Handle vulnerabilities throughout the support period, with SBOM and free security updates Anhang I Teil II CRA
Technical documentation, conformity assessment, EU declaration of conformity and CE marking, from 11 December 2027 Art. 71 CRA
Protection against corruption and safety of the control system under the Machinery Regulation, from 20 January 2027 Annex III 1.1.9 MR

Not sure which frameworks apply to you? Start the applicability check
Costs, effort and time: consultant without Complass, consultant with Complass or in-house with Complass? Open the compliance cost calculator

General information, not legal advice. This page summarises the legal position in simplified form and does not replace an assessment of your individual case. The wording of the laws and standards is authoritative.

Sectors and products

Machine and plant engineering Focus area

CRA and Machinery Regulation side by side per machine, from the controller to remote access. The area Complass covers in the greatest depth.

Components, controllers and IoT

PLCs, sensors and connected devices with IEC 62443-4-2 as the basis. Radio products additionally under the Radio Equipment Directive with EN 18031.

Software

Standalone software with digital elements falls under the CRA. Pure cloud services without an associated product are usually governed by NIS2 rather than the CRA.

Connected products and AI

Data access for users of connected products under the Data Act, AI functions in the product under the AI Act.

How Complass helps

CRA per product

Classification as a default, important or critical product, Annex I requirements, conformity assessment and documentation up to CE marking.

More about this feature

SBOM and vulnerabilities

Maintain an SBOM per product and export it as CycloneDX or SPDX. Find and assess known vulnerabilities of the components and state them as VEX.

Learn more

Reporting obligations

Check whether a vulnerability or an incident must be reported, and track the CRA deadlines with a countdown.

More about this feature

Secure development

Secure product development per IEC 62443-4-1 and component requirements per 62443-4-2, linked with the CRA.

What you need at a minimum as a manufacturer

If you are a manufacturer under the CRA, this selection covers the obligations in Complass. The free applicability check shows whether it does.

minimum selection manufacturer

Start package, size S, with Vulnerabilities and attack techniques

€348 net per month

Cyber Resilience Act (CRA): Essential requirements, conformity assessment and CE marking. (Art. 13 CRA (opens in a new tab))
Vulnerabilities and attack techniques (incl. SBOM, CRA product file, MITRE ATT&CK): Handle vulnerabilities and send an early warning on actively exploited vulnerabilities within 24 hours. (Art. 14, Annex I Part II CRA (opens in a new tab))+ €149
Incident management
GDPR, AI Act and Whistleblower protection (HinSchG) (baseline protection)

Try free for 14 days Order

Recommended

Business

€739 net per month

More impact with Asset management and zones, Supplier Management and Business continuity management (BCM), room for 10 users and 2 frameworks.

Try Business

Further matching packages

For products under the CRA there is the Manufacturers industry template. Manufacturers of medical devices do not fall under the CRA; the medical technology template is intended for them.

Prices for businesses, net plus VAT, with annual payment and a 12-month minimum term. Monthly payment with a 15 % surcharge. As of 6 November 2026. Enterprise and groups of companies on request. All packages in the price overview

You can also meet the obligations without Complass. Complass supports implementation and evidence and does not replace legal advice. Legal information

Frequently asked questions

Does our product fall under the CRA?

The CRA applies to products with digital elements that can be connected directly or indirectly to a device or network. This covers most controllers, connected machines and software. There are exceptions, among others, for products with their own rules, such as medical devices and vehicles. The applicability check and the per-product classification in Complass show which class your product falls into.

How are the CRA and the Machinery Regulation related?

Both require cybersecurity, from different angles: the CRA for the product with digital elements, the Machinery Regulation for the safe functioning of the machine. You can use many documents, such as the risk assessment and technical documentation, for both. Complass keeps both frameworks side by side per product.

We manufacture and also run our own production. Do we need two solutions?

No. In Complass you manage your products under the CRA and the Machinery Regulation and your own operation under NIS2, ISO 27001 or IEC 62443 in the same account.

Other roles: Importers and distributors Operators Suppliers and service providers All audiences at a glance

For manufacturers: Security is now part of the product