December 2027 can feel like a comfortably distant deadline. However, the countdown to full enforcement of the European Union's Cyber Resilience Act (CRA) is already running, with several of its most demanding requirements taking effect more than a year earlier than that deadline date.
For manufacturers that sell products with digital elements (PDEs) into Europe - regardless of where they are headquartered - the time to treat the CRA as a future problem has passed.
The CRA requires manufacturers to build cybersecurity into products across their entire lifecycle, from design through end of support. It also gives users clear, accessible information about how a product is secured and how vulnerabilities are managed.
To enforce those goals, the regulation imposes product lifecycle accountability, formal risk and conformity assessments, allied to mandatory vulnerability reporting. The penalties for getting this wrong are substantial: fines can reach roughly $17 million or 2.5 percent of global annual revenue, whichever is greater. For a $10 billion company, that ceiling translates into a quarter-billion-dollar exposure.
Although full enforcement comes into effect in December 2027, the transition period is already well underway. Beginning in September 2026, manufacturers must be able to report actively exploited vulnerabilities and serious incidents to EU authorities within 24 hours of becoming aware of them.
That is not a distant compliance milestone. It is an operational capability that must exist well before the deadline, which means the underlying monitoring, escalation and reporting processes need to be built and tested now.
Machine builders face an added layer of complexity. The EU's Machinery Regulation, which replaces the long-standing Machinery Directive with no transition window, takes effect January 20, 2027. Unlike its predecessor, it applies uniformly across all EU member states, with no room for local interpretation.
It also introduces essential health and safety requirements that explicitly cover cybersecurity for machinery and control systems. The Machinery Regulation and the CRA were written to work together, but manufacturers now have to satisfy both frameworks in parallel, on overlapping timelines, often with the same engineering and compliance resources.
The Real Risk
The most immediate consequence of falling behind isn't a fine but the inability to sell. A product that hasn't completed the required conformity assessment simply cannot carry the CE marking needed to enter the European market.
For original equipment manufacturers (OEMs) shipping complex machinery with dozens of components sourced from multiple suppliers, that risk compounds quickly. A machine builder shipping over a thousand units a year, each with dozens of individual hardware and firmware components, is effectively being asked to maintain a live, auditable inventory of every one of those components, for every machine, for as long as that machine is supported in the field and to notify end users whenever a security-relevant update affects something they've already shipped.
That is a fundamentally different operating model than the one most manufacturers have used for decades. The old approach of design, validate, apply the CE mark and move on, is being replaced by a continuous maintenance obligation that follows a product for its entire service life. Manufacturers that treat this as a “one and done” certification exercise will find themselves out of compliance again the moment a component changes or a new vulnerability is disclosed.
Compliance as a Source of Resilience, Not Just Risk Avoidance
Approached correctly, the shift the CRA is forcing isn't purely a burden. Manufacturers that build continuous risk assessment and asset visibility into their operations gain something they've historically lacked: an accurate, current picture of what's running across their installed base.
That visibility supports faster incident response, more informed maintenance planning and better prioritization of which systems need attention first. Industry standards bodies are moving to support this shift, with new guidance emerging that pairs traditional hazard identification methods with structured cybersecurity risk scoring. This gives manufacturers a repeatable way to assess and mitigate cyber-related risk alongside conventional safety risk, rather than treating the two as separate exercises.
Getting There Without Disrupting the Floor
Operational technology environments don't tolerate the same remediation tactics IT teams rely on. Manufacturers can't push untested patches or run aggressive vulnerability scans against production control systems without risking unplanned downtime. And that downtime is often a bigger business risk than the vulnerability itself. Meeting CRA requirements without disrupting uptime comes down to a few practical shifts:
- Build security into the design phase. Data confidentiality, integrity controls and least-privilege access should be architectural decisions made at the start of product development, not retrofits applied under deadline pressure.
- Automate asset visibility. Manually tracking hardware versions, firmware revisions and software bills of materials across a large installed base doesn't scale to CRA reporting timelines. Automated, continuous monitoring is what makes 24-hour incident reporting realistic rather than aspirational.
- Break down organizational silos. Cybersecurity, functional safety and regulatory affairs have traditionally operated as separate disciplines within manufacturing organizations. The CRA and Machinery Regulation both assume they work together, so the teams responsible for them need to as well.
- Anchor decisions to proven, internationally recognized frameworks. Rather than building bespoke compliance programs from scratch, following standards-based approaches are easier to defend, easier to audit and more adaptable as regulatory requirements continue to evolve. This goes beyond the EU to other markets that are watching the CRA closely as a model.
The manufacturers that start this work now, well ahead of the key deadlines, will be the ones still able to ship into Europe without interruption. Competitors caught flat-footed will be the ones scrambling to catch up.
