‍Cybersecurity has long been part of machinery safety. With the Cyber Resilience Act and the new Machinery Regulation, two cybersecurity obligations now meet on the same connected product. The guiding principle remains the same throughout: security measures must never impair safety functions.

‍‍

Connected controllers, remote maintenance, sensors with an Ethernet interface: what makes production more efficient also opens up new attack surfaces. The legislator has responded. Regulation (EU) 2023/1230 on machinery (the Machinery Regulation) applies from 20 January 2027, and the Cyber Resilience Act (Regulation (EU) 2024/2847, "CRA") applies in full from 11 December 2027 – and the CRA's first reporting obligations apply as early as 11 September 2026. For manufacturers of connected machinery, this means that cybersecurity becomes a fixed part of CE marking. Anyone who works through the two regulations separately creates double the effort. Anyone who thinks of them together saves effort – and builds safer machines.

‍Two regulations, one product – two protection goals

Both regulations touch on cybersecurity, but they pursue different goals. This distinction is the key to understanding the whole interface.

The Machinery Regulation pursues a safety goal: it protects people from hazards arising from machinery. What is new is that these hazards now include malicious interference by third parties. If an attacker manipulates the control system of a press and a person is injured as a result, that is a safety problem with a security cause. Specifically, Annex III for the first time requires protection against corruption (section 1.1.9) as well as the safety and reliability of control systems (section 1.2.1).

The Cyber Resilience Act pursues a security goal: it protects products with digital elements against cyberattacks throughout their entire life cycle – regardless of whether a physical hazard arises. Data loss, ransomware or the misuse of a device as part of a botnet are CRA-relevant scenarios with no direct bearing on the physical safety of machinery.

Both legal acts apply in parallel. A connected machine can be both machinery within the meaning of the Machinery Regulation and a product with digital elements within the meaning of the CRA – and must then meet both sets of requirements.

‍The principle: security must never weaken safety

However closely security and safety move together, they do not have equal rank. In machinery safety, protecting life and limb takes priority. This gives rise to a principle that binds every cybersecurity measure on a machine: a security measure must never override or delay a safety function.

That sounds self-evident, but in practice it has teeth:

A security update must not disable a safety-related function or put it into an undefined state.
Access control or authentication must never block an emergency stop – the safe state must remain reachable at all times.
Encryption or network segmentation must not extend the response time of safety-relevant signals beyond the permissible limit.
"Hardening" the control system must not result in the machine no longer being able to stop safely in the event of a fault.

This priority of safety is also anchored in the relevant guidance on integrating functional safety and security (IEC TR 63069). For design, this means that safety and security requirements are not considered one after the other but together – with a clear priority whenever they conflict.

‍Where the two meet in the CE process

In the practical CE process, there are concrete touchpoints where safety and security interlock:

Extend the risk assessment: in addition to the familiar safety hazards, consider how malicious interference could trigger a dangerous situation. Threat analysis becomes part of the risk assessment.
Demonstrate protection against corruption: the Machinery Regulation requires that safety-relevant software, parameters and data cannot be manipulated unnoticed (Annex III, 1.1.9) and that control systems are reliably protected against faulty influence (1.2.1).

Security by design and vulnerability management: the CRA requires secure development, active vulnerability management and security updates over an appropriate support period – for many products at least five years.
Set up reporting chains: from 11 September 2026, actively exploited vulnerabilities and severe incidents must be reported – the early warning within 24 hours, the follow-up notification within 72 hours, and the final report within 14 days.

Documentation and instructions: safe commissioning, recommended configuration and the handling of updates belong in the technical documentation and in the instructions.

Each of these points generates evidence – and this is precisely where it is decided whether a double obligation becomes double work.

‍Double obligation, one body of evidence: using synergies

The good news: parallel applicability does not necessarily mean double work. The Union legislator has expressly addressed the overlap. According to recital 53 of the CRA, compliance with the CRA's essential cybersecurity requirements can at the same time cover the safety-relevant requirements of sections 1.1.9 and 1.2.1 of Annex III to the Machinery Regulation – provided the manufacturer demonstrates this.

In practice, this means one risk analysis, one measures concept and one documentation structure – instead of three parallel projects. The prerequisite is that the evidence cross-refers cleanly and remains consistent.

On the standardisation side, prEN 50742 ("Safety of machinery – Protection against corruption") is emerging as an important bridge intended to make the requirements of the Machinery Regulation more concrete. Important: until the standard is finally adopted and listed in the Official Journal of the EU, it does not yet give rise to a presumption of conformity. Until then, the technical derivation from the state of the art remains in demand.

‍What manufacturers should do now

The timetable is tight – the three key dates, 11 September 2026, 20 January 2027 and 11 December 2027, are coming faster than it seems. Sensible first steps:

- Product screening: which machines are connected or contain digital elements? Which interfaces exist?
- Clarify applicability: does the product fall under the Machinery Regulation, the CRA, or both? Does it fall into one of the CRA product categories with a stricter conformity assessment?
- Integrated risk analysis: bring safety and security considerations together, with a clear safety priority in the event of conflict.
- Anchor security by design: consider secure architecture, update capability and vulnerability management from the outset.
- Build evidence and reporting processes: establish documentation, traceability and a robust 24-hour reporting chain.

Those who take these steps early will face an orderly process in 2027, not a last-minute scramble.

‍One data source for safety and security

This is exactly where the value of a continuous data basis shows. When the risk assessment, measures, instructions and conformity evidence come from a single source, safety and security requirements can be linked without contradiction – and one piece of evidence can be reused for both regulations instead of being maintained twice.

CERTAIN is designed around this principle: a single source of truth, consistency between the risk assessment and the instructions, and end-to-end version control. This makes changes traceable – an advantage when a market surveillance authority asks about the interplay of safety and security, or when a security incident has to be documented.

‍Closing thoughts

The Cyber Resilience Act and the Machinery Regulation mark a turning point: cybersecurity becomes a binding part of machinery safety and CE marking. The real skill lies not in working through two regulations separately, but in bringing them together at their points of contact – with a clear principle as a guardrail: security strengthens safety, but never weakens it. Those who bring safety and security together in a consistent, traceable process turn a double obligation into a real competitive advantage.

Would you like to map safety and security in one continuous, audit-ready CE process? Get to know CERTAIN at certain-cloud.com.

‍