01Typical products
- PLCs and remote I/O
- HMI panels and operator terminals
- Connected sensors and measuring devices
- Motor drives and motion controllers
- Industrial gateways, routers and switches
02Likely CRA class
Most PLCs, HMIs, sensors and drives are default class; their core functions do not fall into an Annex III or IV category.
There are exceptions: industrial routers and switches are in Annex III Class I ("routers, modems and switches"), and devices whose core function is firewalling or intrusion detection are Class II. A product acting as a network management system is also Class I.
Using a microcontroller with security functions does not by itself make a product Class I; the class follows the product's core functionality. Try our class check for your product.
03Other rules that apply
- NIS2 (EU) 2022/2555: Essential and important entities in sectors such as energy, water, transport and manufacturing must manage supply chain security (Article 21). These customers ask suppliers for an SBOM, vulnerability handling and update commitments.
- Machinery Regulation (EU) 2023/1230: Applies from 20 January 2027. Its Annex III requirements 1.1.9 (protection against corruption) and 1.2.1 (safety and reliability of control systems) also cover malicious attempts. A connected machine component may fall under both this regulation and the CRA.
- IEC 62443: A family of security standards widely used in industrial automation. Customers and auditors often refer to it.
04Challenges specific to this industry
- Very long product life: devices that run in the field for 10 to 20 years; the support period and update plan must reflect that.
- Update windows: a device on a production line cannot be updated at any moment; updates must be secure and verifiable.
- Customer audits: customers under NIS2 ask suppliers for documents for their own audits; preparing the same evidence for each customer takes time.
- Mixed software stacks: RTOS, embedded Linux and third-party protocol stacks side by side make the component inventory hard.
05What the platform does here
- Builds the component inventory from firmware images and supplier SBOMs, and scans it continuously for new vulnerabilities.
- Prioritises vulnerabilities with CISA KEV and EPSS; CSAF 2.0 and OpenVEX output gives your customers machine-readable evidence.
- Collects tampering and memory corruption events reported by devices; critical device events automatically open an assessment record and your team decides whether they must be reported.
- Tracks Article 14 deadlines from the moment of becoming aware.
- Signed OTA updates with A/B slots and anti-rollback protection.
- Technical documentation drafts and a signed, RFC 3161 timestamped evidence archive kept unaltered for 10 years; reuse the same evidence in customer audits.
06Frequently asked questions
Which CRA class are PLCs?
Most are default class; a PLC's core function does not fall into an Annex III or IV category. If the product acts as a router, switch or firewall, the class may change.
My customer is under NIS2. What will they ask me for?
Usually an SBOM, a vulnerability handling process, a security update commitment and a contact for incident reporting. CRA evidence covers most of these requests.
Do the Machinery Regulation and the CRA apply together?
A connected machine component may fall under both. The Machinery Regulation applies from 20 January 2027, all CRA obligations from 11 December 2027.
Let's talk about your product
We run a free CRA pre-scan of a firmware you choose: components, priority vulnerabilities, likely class and the three biggest gaps.
Other industries
General information, not legal advice. A product's class follows its core functionality; the technical descriptions of the categories are in Implementing Regulation (EU) 2025/2392.