CRA and the Machinery Regulation for machine builders

This guide shows what each regulation requires, where the requirements overlap and how to do the work only once. The examples are invented.

Two regulations, two perspectives

The Machinery Regulation protects people from hazards caused by the machine. Compared with the Machinery Directive, Annex III adds two requirements with a cyber angle:

• Section 1.1.9, protection against corruption: Connecting other devices and remote access must not lead to a hazardous situation. Safety-relevant hardware, software and data must be identified as such and adequately protected against accidental or intentional corruption. The machine must identify its safety-relevant software and collect evidence of interventions.
• Section 1.2.1, safety and reliability of control systems: Control systems must also withstand reasonably foreseeable malicious attempts by third parties that lead to a hazardous situation. Interventions and versions of safety software uploaded later are kept in a tracing log.

The CRA looks further. For products with digital elements it requires an appropriate level of cybersecurity overall (Annex I Part I), plus vulnerability handling and security updates over the support period (Annex I Part II) and reports to the authorities (Art. 14, since 11 September 2026). Whether your product is in scope follows from Art. 2(1): it needs a direct or indirect data connection to a device or network. Most connected machines meet that test.

What overlaps and what does not

The table shows similar topics, but not the same yardstick. The Machinery Regulation asks whether an attack can lead to a hazard. The CRA asks whether the product is adequately protected at all, even when no person is at risk, for example in case of data leakage or an outage.

Is there a presumption of conformity through the CRA?

No, not an automatic one. Recital 53 of the CRA says that meeting the CRA requirements can facilitate compliance with Annex III sections 1.1.9 and 1.2.1 of the Machinery Regulation. The manufacturer has to demonstrate this link, for example with harmonized standards or other technical specifications after a risk assessment. The conformity assessment procedures of both regulations must be followed.

The Machinery Regulation provides a real presumption of conformity for 1.1.9 and 1.2.1 in two ways:

• Harmonized standards under Regulation (EU) 2023/1230, as far as they cover the requirement (Art. 20(1)). As of November 2026, no harmonized standard under the Machinery Regulation had been published in the Official Journal; the Commission has announced the first list for the end of 2026. The lists under the Machinery Directive 2006/42/EC do not carry over automatically. Check the current status before you rely on it.
• Cybersecurity certification under Regulation (EU) 2019/881 (Art. 20(9)), as far as the certificate or statement covers the requirements and the scheme has been referenced in the Official Journal. A certificate for a single component does not automatically cover the whole machine.

Without a presumption, other specifications such as IEC 62443-4-2 remain valid evidence. You then justify in the technical file why the requirements are met (Annex IV Part A).

A note on Art. 12 CRA: it covers high-risk AI systems under the AI Act, not machinery in general. The duty to keep a single technical documentation under Art. 31(3) CRA also applies only to those products. For other machines a joint documentation makes sense but is not mandatory.

Five steps to do the work only once

1. Classify. For each machine or product line, clarify: machinery, related product or partly completed machinery? Does it have digital elements with a data connection? What role does your company have?
2. One threat analysis. Write one analysis for both regulations and mark the scenarios that can endanger people. These also go into the risk assessment under Annex III.
3. One development process. A secure development process, for example based on IEC 62443-4-1, supports both regulations.
4. One requirements list. Map the component requirements, for example from IEC 62443-4-2, to CRA Annex I and to Annex III sections 1.1.9 and 1.2.1. You then see which evidence counts more than once.
5. One declaration. Issue a single EU declaration of conformity that lists both acts with their references (Art. 21(3) Machinery Regulation, Art. 28(3) CRA). Keep the update concept and the technical documentation together with cross-references.

The short gap between the two dates helps: if you build the evidence for 1.1.9 and 1.2.1 from the same risk assessment in 2027, a large part of the CRA work is already done.

Example from machine building

The example is invented. A maker of packaging machines ships a product line with a safety controller, an operator panel and a gateway for remote service.

• Classification: The machine falls under the Machinery Regulation. Panel and gateway have a data connection, so the machine is also a product with digital elements under the CRA.
• Shared analysis: Four threat scenarios, two of them with a hazard to people, such as a manipulated parameter of the guard door. These two also go into the risk assessment under Annex III.
• Prove it once: Access control, firmware integrity checks and logging are tested once. The report counts for CRA Annex I and for 1.1.9 and 1.2.1.
• Result: One EU declaration of conformity for the Machinery Regulation, the CRA and the EMC Directive, one update concept, one technical documentation with cross-references.

Checklist

• Each machine or product line is classified under the Machinery Regulation and the CRA.
• Your company's role is clear, including for modifications.
• There is one threat analysis, and scenarios with hazards to people are marked.
• The risk assessment under Annex III covers cyber threats.
• The route of evidence for 1.1.9 and 1.2.1 is set: standard, certification or your own justification.
• Component requirements are mapped to both regulations.
• Safety-relevant software is identifiable, and interventions are logged.
• Update concept and support period are set.
• The EU declaration of conformity lists all acts with their references.

The CRA and the Machinery Regulation in Complass

Two spreadsheets, two folders of evidence and a declaration that bounces by email between engineering and quality management: that is how work gets done twice. In Complass both regulations work together:

• Applicability check: It checks whether the CRA and the Machinery Regulation apply to your company, with reasoning and legal reference.
• Machinery Regulation module: Nine phases to CE marking, a catalog of Annex III requirements with a cyber angle and templates, including the threat analysis, the evidence for 1.1.9 and 1.2.1 and the software and update concept.
• Prove it once: "Also required in" shows where the same control counts in another framework. With "Link" you take over status, evidence text and files from the other project on an ongoing basis.
• Product file: Per product and version, requirements from CRA Annex I and Machinery Regulation Annex III, support period, SBOM and conformity status sit in one place.
• Joint declaration: The product file produces a draft EU declaration of conformity for the CRA and the Machinery Regulation. The decision and the signature stay with you.

Frequently asked questions

Is CE marking under the Machinery Regulation enough for the CRA?

No. If the machine falls under both regulations, you must meet both and complete the conformity assessment under both. The single EU declaration of conformity then lists both acts.

Does a CRA-compliant machine automatically meet 1.1.9 and 1.2.1?

No. Recital 53 CRA speaks of facilitation, not presumption. You have to justify why your CRA measures cover the Machinery Regulation requirements.

Which date comes first?

The Machinery Regulation applies from 20 January 2027, the CRA in full from 11 December 2027. The reporting obligations under Art. 14 CRA have applied since 11 September 2026.

We modify plants at customer sites. Does this affect us?

Possibly. Anyone who substantially modifies a machine counts as its manufacturer under the Machinery Regulation (Art. 18). Assess each modification on its own, including pure software changes.

Do we need two technical files?

In content, you need the information under Annex IV Part A of the Machinery Regulation and under Annex VII CRA. How you bundle it is up to you. A joint documentation with cross-references saves upkeep.

In a demo we use the demo company to show you how one threat analysis turns into evidence for the CRA and the Machinery Regulation.

Request a demo Try it for 14 days

Read more

• Guide "Does the CRA apply to you? Five questions"
• Guide "CRA conformity assessment and CE marking"
• Guide "CRA and IEC 62443: where they overlap"
• Whitepaper on the Machinery Regulation
• Machinery Regulation in Complass

Not legal advice. This guide gives a general overview and does not replace an assessment of the individual case. The current wording of Regulations (EU) 2023/1230 and 2024/2847 and your licensed editions of the standards are authoritative. As of November 2026.