Skip to content
CRA Reporting Desk

CRA Article 14 for machinery: Machinery Regulation dual scope vs reporting

Machine builders often treat a Machinery Regulation CE file as if it were an MDR-style CRA exclusion. It is not. Connected machinery can sit in both the Cyber Resilience Act and Regulation (EU) 2023/1230 at once — and Article 14's 24-hour / 72-hour SRP chain already runs when the CRA product tests are met.

The short version

  • Not an Article 2 exclusion: machinery is interplay (FAQ 2.4 / Recital 53), not carved out like MDR, vehicles, aviation or marine equipment.
  • Dual scope is normal: a connected machine can be a CRA product with digital elements and MR machinery / related product at the same time.
  • One regime ≠ the other: FAQ 2.4.2 — CRA cyber compliance does not automatically satisfy MR cyber-safety requirements (or the reverse).
  • Article 14 is live now: from 11 September 2026 for in-scope products; MR application from 20 January 2027 does not delay SRP.
Track your Article 14 clockOpen the deadline calculator

What FAQ 2.4 and Recital 53 actually say

Commission FAQ 2.4.1 reproduces Recital 53: manufacturers of products falling within the Machinery Regulation that are also products with digital elements under the CRA should comply with both CRA essential cybersecurity requirements and MR essential health and safety requirements. CRA Annex I and MR Annex III sections 1.1.9 and 1.2.1 (protection against corruption; safety and reliability of control systems) may address similar risks — CRA compliance can facilitate MR compliance, but synergies must be demonstrated (risk assessment, harmonised standards or other technical specifications where available). Manufacturers also follow the conformity assessment procedures in each instrument.

FAQ 2.4.1's worked example is deliberate: food-packing machinery under the MR that contains hardware and software to ensure its functioning can also be a CRA product with digital elements. FAQ 2.4.2 states the hard rule teams miss: compliance with only one regulation's cybersecurity requirements cannot automatically be treated as fully satisfying the other. FAQ 2.4.3 says the same for procedures — CRA Article 32 assessment does not replace Machinery Regulation Article 25 assessment, and the reverse is also true.

Article 14 clocks still attach inside CRA scope

Article 14 obliges manufacturers to notify actively exploited vulnerabilities and severe incidents having an impact on the security of the product with digital elements — early warning within 24 hours of becoming aware, fuller notification within 72 hours, then the final report on its own trigger — through ENISA's Single Reporting Platform. Those clocks attach when you are the manufacturer of an in-scope CRA product and awareness hits. They do not wait for Machinery Regulation application on 20 January 2027, for a completed dual conformity file, or for 11 December 2027 Annex I application.

Keep the Article 14 reporting deadlines, becoming-aware and legacy-products guides ready for machines already running at customer sites. Article 69(3) keeps reporting on in-scope products placed before 11 December 2027.

The trap: “we’re under the Machinery Regulation, so SRP can wait”

Safety and CE teams often copy the medical-device mental model: another Union act applies, therefore CRA (and Article 14) does not. For MDR/IVDR, vehicles, aviation and marine that can be true under Article 2. For machinery it is false. FAQ 2.4 is titled interplay, not exclusion. An MR CE mark, notified-body opinion or cyber-safety control-system file is not an ENISA SRP early warning.

Inventory each SKU for CRA connection and product definition first (PLC, HMI, fieldbus, remote maintenance, manufacturer app / backend — see remote data processing). Then map who is the manufacturer under brand-under-name / OEM-ODM rules. A non-connected machine whose intended and reasonably foreseeable use has no direct or indirect data connection can fall outside CRA Article 2(1) even if it remains MR machinery — that is a connection/scope test, not an MR-for-CRA swap.

Other regimes are not substitutes

Personal data in a connected-machine incident can still raise GDPR duties (CRA vs GDPR), and some manufacturers also sit in NIS2 sectors (CRA vs NIS2). Neither replaces an SRP filing for an in-scope manufacturer product. For true CRA product-class exclusions, see medical devices, motor vehicles, aviation and drones, marine equipment, identical spare parts and national security and defence. Radio equipment under Delegated Regulation (EU) 2022/30 stays in CRA (RED / radio equipment) — another dual-calendar pattern, not an exclusion. Connected consumer products under GPSR (EU) 2023/988 follow the same dual-scope logic on the retail side (GPSR / consumer products).

Questions people ask

Do industrial machines have a CRA Article 14 reporting duty?
Yes when the machine is a product with digital elements inside CRA Article 2(1) / Article 3(1) — typically because its intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network. Machinery is not on the Article 2(2)–(4) exclusion list (unlike MDR/IVDR devices, type-approved vehicles, EASA-certified aviation products or 2014/90 marine equipment). Commission FAQ 2.4.1 and Recital 53 treat dual CRA + Machinery Regulation (EU) 2023/1230 scope as the normal case for connected machinery, not a reporting holiday.
Does the Machinery Regulation replace CRA Article 14?
No. FAQ 2.4.1 / Recital 53 say manufacturers of products in both regimes must comply with CRA essential cybersecurity requirements and MR essential health and safety requirements (including MR Annex III sections 1.1.9 and 1.2.1 on protection against corruption and safety/reliability of control systems). FAQ 2.4.2 adds that complying with only one regulation’s cybersecurity requirements does not automatically satisfy the other. Article 14 SRP filing is a CRA manufacturer duty; an MR technical file or CE procedure is not an ENISA Single Reporting Platform submission.
Our line is CE-marked under the Machinery Directive / Regulation — are we out of CRA?
Not for that reason alone. Article 2 excludes specific Union acts (medical, vehicles, aviation, marine, identical spare parts, exclusive national security/defence, and related limbs). Regulation (EU) 2023/1230 is interplay legislation under FAQ 2.4, not an Article 2 carve-out. Map each SKU for CRA connection/scope first; then ask whether it is also machinery or a related product under the MR.
When do the calendars start — MR vs Article 14?
Article 14 has applied from 11 September 2026 (Article 71(2)), including for in-scope products already on the market (Article 69(3)). FAQ 2.4.1 notes the Machinery Regulation applies from 20 January 2027. Do not wait for the MR application date — or for 11 December 2027 Annex I conformity — before running the 24-hour / 72-hour SRP chain on a connected machine that is already a CRA product.
Is a standalone PLC, HMI or remote-maintenance gateway in scope even if the host machine is old?
Often yes as a separate product with digital elements when placed on the market, and the finished machine can also be in CRA scope when it has a direct or indirect data connection (PLC, operator panel, fieldbus, remote maintenance, app). FAQ 2.4.1’s food-packing example is exactly that dual characterisation. Legacy machines already placed before 11 December 2027 still face Article 14 under Article 69(3) when in scope — see our legacy-products guide. Who is the manufacturer (machine builder vs brand) follows Article 3(13) / white-label rules.
How is this different from medical devices or motor vehicles?
Those product classes can leave the CRA entirely under Article 2(2) when the listed Union act applies — so Article 14 does not attach to that excluded product. Machinery is the opposite pattern: FAQ 2.4 keeps CRA and MR running in parallel for dual-scope products. See our medical-devices and motor-vehicles guides for the exclusion-style trap; this page is for the dual-compliance trap.

Track Article 14 on connected machinery now

Use the free desk or deadline calculator for 24-hour, 72-hour and final-report dates on in-scope machines — including lines that also carry Machinery Regulation CE work and stock already at customer sites. No sign-up; data stays in your browser. Official CRA filing still goes through ENISA; MR conformity stays on its own path.

Track your Article 14 clockOpen the deadline calculator

Workflow support, not legal advice. Whether a given SKU is a product with digital elements under the CRA, machinery or a related product under Regulation (EU) 2023/1230, who is the manufacturer, and which clocks run for a security event are determinations for qualified counsel. Claims above track Regulation (EU) 2024/2847 Articles 2(1), 3(1), 14, 32, 69(3) and 71(2), Recital 53, and Commission FAQ 2.4.1–2.4.3 as reproduced on the ORC WG mirror. Confirm against the Official Journal text (CRA on EUR-Lex), the Machinery Regulation text and the Commission FAQ before relying on this for a live case.