A manufacturer in Europe can be regulated three times over for cyber security: as an operator running factories, as a maker of connected products and as a builder of machinery, and each role brings a different law, clock and penalty. NIS2 treats many manufacturers as entities whose own networks must be secured. The Cyber Resilience Act (CRA) regulates the products with digital elements they place on the market. The Machinery Regulation adds cyber-related safety requirements for machines, and the IEC 62443 series gives the voluntary engineering language most auditors, customers and integrators use to show how all of this is done. This map sets out which instrument applies to which manufacturer role, where the obligations overlap, and which NHI Mgmt Group guide covers each one in depth. It is written for manufacturing CISOs, OT security leads, product security and PSIRT teams, safety engineers and compliance owners. Status as of 14 November 2026: dates and figures are taken from EUR-Lex and European Commission pages checked on that date, so confirm them against the official texts before acting.
Key takeaways
- Your role decides your law, not your sector label. The same company can be an important entity under NIS2 for its plants, a manufacturer under the CRA for its connected products, and a manufacturer under the Machinery Regulation for its machines, with a separate set of duties for each.
- NIS2 names six manufacturing subsectors. Annex II covers medical devices and in vitro diagnostics, and NACE divisions 26 to 30: computer, electronic and optical products, electrical equipment, machinery and equipment n.e.c., motor vehicles and trailers, and other transport equipment. Chemicals and food production are separate Annex II sectors.
- Three different reporting clocks can run for one event. NIS2 asks for a 24 hour early warning on a significant incident affecting your services; the CRA asks for a 24 hour early warning on an actively exploited vulnerability or severe incident affecting your product, from 11 September 2026. The Machinery Regulation has no incident clock but requires evidence and tracing logs.
- Modifying equipment can make you the manufacturer. Article 18 of the Machinery Regulation and Article 22 of the CRA both treat a person who makes a substantial modification as a manufacturer, which catches integrators and plant operators who retrofit connectivity or control software.
- Identity is the common control. NIS2 Article 21(2)(i) and (j) name access control and multi-factor authentication, and the CRA and Machinery Regulation both expect protection against unauthorised access and tampering, so remote maintenance accounts, update signing keys and service identities sit in every regime.
Regulations and frameworks at a glance
| Instrument | What it regulates | Manufacturer role it targets | Status as of 14 November 2026 | Detailed guide |
|---|---|---|---|---|
| NIS2, Directive (EU) 2022/2555 | Security of the entity's own network and information systems | Operator: manufacturers in Annex II sectors above the size cap | Transposition deadline 17 October 2024, national measures to apply from 18 October 2024; national laws vary and some are late | NIS2 Directive Guide |
| Cyber Resilience Act, Regulation (EU) 2024/2847 | Products with digital elements, hardware and software | Product maker, importer, distributor, and anyone who substantially modifies a product | In force 10 December 2024; Chapter IV (notified bodies) from 11 June 2026; Article 14 reporting from 11 September 2026; main obligations from 11 December 2027 | EU Cyber Resilience Act Guide |
| Machinery Regulation, Regulation (EU) 2023/1230 | Safety of machinery, related products and partly completed machinery, including cyber-related safety | Machine builder, and anyone who substantially modifies a machine | Adopted 14 June 2023; applies from 20 January 2027 per the Commission (a corrigendum corrected the application dates); the Machinery Directive 2006/42/EC applies until then | EU Machinery Regulation Cybersecurity Guide |
| ISA/IEC 62443 series | Security of industrial automation and control systems (IACS) | Asset owner, service provider and integrator, product supplier | Voluntary consensus standards; current parts include ANSI/ISA-62443-2-1-2024 and ANSI/ISA-62443-4-1-2018 | IEC 62443 Guide |
Cross-sector critical infrastructure rules are in the Critical Infrastructure Regulation Map, and consumer product regimes outside the EU (UK PSTI, Australia, US Cyber Trust Mark) are in the Product Security Laws Map. Neither is repeated here.
Obligations by manufacturer role
This is the core of the map. Read across the row for the role you play; most manufacturers play more than one.
| Role | NIS2 | CRA | Machinery Regulation | IEC 62443 part usually asked for |
|---|---|---|---|---|
| Plant operator (runs production sites) | In scope if in an Annex II sector and above the size cap: Article 21 risk-management measures, Article 23 reporting, Article 20 management accountability | Not a manufacturer duty, but buys CRA-compliant products and can ask for support periods and SBOM evidence | User of machinery; becomes manufacturer only if it makes a substantial modification | 62443-2-1 asset owner security programme; 62443-3-2 risk assessment |
| Maker of connected components (PLCs, gateways, sensors, HMIs, network devices) | In scope as an operator if in NACE 26 or 27 and above the size cap | Manufacturer duties under Article 13 and reporting under Article 14; some product types are listed in Annex III or IV | Out of scope unless the product is a safety component or related product | 62443-4-1 secure development lifecycle; 62443-4-2 component requirements |
| Machine builder (OEM) | In scope as an operator if in NACE 28 and above the size cap | Manufacturer duties for the machine's digital elements where the machine is a product with digital elements | Manufacturer: design to Annex III, conformity assessment, technical documentation, CE marking | 62443-4-1 and 4-2 for the control system; 62443-3-3 for system level |
| System integrator or machine retrofitter | Depends on its own sector and size; often a supplier whose security NIS2 customers must assess under Article 21(2)(d) | Becomes manufacturer under Article 22 on a substantial modification placed on the market | Becomes manufacturer under Article 18 on a substantial modification | 62443-2-4 service provider requirements; 62443-3-3 system requirements |
| Importer or distributor of equipment | Depends on its own sector and size | Importer and distributor duties; treated as manufacturer under Article 21 if it rebrands or substantially modifies | Importer and distributor checks on marking and documentation | Usually asks suppliers for 4-1 and 4-2 evidence |
| Medical device manufacturer | Annex II manufacturing subsector (a) | Excluded: Article 2(2) lists Regulations (EU) 2017/745 and 2017/746 | Separate product law applies | Sometimes used alongside the device rules |
| Motor vehicle manufacturer | Annex II manufacturing subsector (e) | Vehicles type-approved under Regulation (EU) 2019/2144 are excluded by Article 2(2) | Vehicles have their own type-approval law | Rarely; vehicle cyber rules differ |
For medical devices see the EU MDR Cybersecurity and MDCG 2019-16 Guide; for vehicles see Automotive Cybersecurity Regulations Compared.
NIS2: the manufacturer as an operator
- Scope: Annex II point 5 lists manufacturing subsectors (a) medical devices and in vitro diagnostic medical devices, and (b) to (f) undertakings carrying out activities in NACE Rev. 2 section C divisions 26, 27, 28, 29 and 30. Annex II point 3 covers manufacture, production and distribution of chemicals by reference to REACH, and point 4 covers food businesses in wholesale distribution and industrial production and processing.
- Classification: under Article 3, essential entities are drawn mainly from Annex I; entities of an Annex I or II type that are not essential are important entities. Most manufacturers in scope are therefore important entities, unless a Member State designates otherwise.
- Measures: Article 21(2) sets the minimum list, from (a) risk analysis and information system security policies to (j) multi-factor or continuous authentication. For a plant, points (d) supply chain security, (e) security in acquisition, development and maintenance, and (i) human resources security, access control and asset management are where OT gaps usually appear.
- Reporting: Article 23(4) requires an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, an intermediate report on request and a final report no later than one month after the notification.
- Supervision: Article 33 applies ex post supervisory measures to important entities, so a manufacturer is more likely to meet its regulator after an incident or a complaint than through routine audit.
Member State laws decide registration, the competent authority and many details. Track them in the NIS2 Transposition Tracker, and see the NIS2 Amending Directive Proposal 2026 page for proposed changes.
CRA: the manufacturer as a product maker
- Scope: Article 2(1) covers products with digital elements made available on the market whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Industrial products are not excluded as a class; the exclusions in Article 2(2) to (4) name medical devices, in vitro diagnostics, vehicle type-approval, certified aviation products and marine equipment.
- Manufacturer: Article 3(13) defines a manufacturer as a person who develops or manufactures products with digital elements and markets them under its name or trademark, whether for payment, monetisation or free of charge.
- Support period and records: Article 13(8) sets a support period of at least five years unless the product is expected to be in use for less time, and Article 13(13) requires technical documentation and the EU declaration of conformity to be kept for at least 10 years or the support period, whichever is longer. Industrial equipment often runs for decades, so the support period you declare is a commercial decision with regulatory consequences.
- Reporting: Article 14(2) requires an early warning on an actively exploited vulnerability within 24 hours, a notification within 72 hours and a final report no later than 14 days after a corrective or mitigating measure is available. Severe incidents follow a similar pattern with a final report within one month.
- Product classes relevant to industry: Annex III class I includes routers, internet-connected modems and switches, network management systems, and microprocessors and microcontrollers with security-related functionalities; class II includes firewalls and intrusion detection or prevention systems and tamper-resistant microcontrollers; Annex IV lists hardware devices with security boxes, smart meter gateways and smartcards or secure elements. Classification drives the conformity assessment route.
The EU CRA Product Classes Guide covers classification, the EU Cyber Resilience Act Vulnerability and Incident Reporting Guide covers the reporting workflow, and the EU Cyber Resilience Act Harmonised Standards Guide tracks the standards that will give a presumption of conformity.
Machinery Regulation and CRA together
The Machinery Regulation's cyber clauses are covered in full in the EU Machinery Regulation Cybersecurity Guide. What matters on this map is how it sits next to the other instruments.
| Question | Machinery Regulation (EU) 2023/1230 | CRA (EU) 2024/2847 |
|---|---|---|
| Purpose of the cyber requirement | Prevent corruption or malicious attempts from creating a hazardous situation; the Commission describes it as cyber-safety for compliance-relevant software, data and safety control systems | Cyber security of the product across its support period, whatever the harm |
| Who is the manufacturer after a change | Article 18: the person making a substantial modification | Article 22: a person who makes a substantial modification and places the product on the market; Article 21 for importers and distributors |
| Presumption of conformity | Article 20(1) via harmonised standards; Article 20(9) via a cybersecurity certification scheme under Regulation (EU) 2019/881, once its reference is published in the Official Journal | Harmonised standards, common specifications or certification schemes, as set out in the Regulation |
| Third-party assessment trigger | Annex I categories, for example safety components with fully or partially self-evolving behaviour using machine learning (Part A, item 5) | Annex III class II and Annex IV products, and class I where harmonised standards are not fully applied |
| Penalties | Article 50: set by Member States, effective, proportionate and dissuasive, and may include criminal penalties for serious infringements | Article 64: up to EUR 15 million or 2.5% of worldwide turnover for essential requirement and Articles 13 and 14 breaches |
| Applies from | 20 January 2027 | 11 December 2027 (reporting from 11 September 2026) |
Practical reading: a connected machine placed on the EU market after both dates will usually need a single risk assessment that answers both questions: could a cyber event make it unsafe (Machinery Regulation), and is it secure by design with a vulnerability handling process for its support period (CRA). Building one technical file with clearly cross-referenced sections avoids two teams producing two incompatible threat models.
IEC 62443: the shared engineering language
None of the EU laws above makes IEC 62443 mandatory, but customers, notified bodies and integrators routinely use it to describe what good looks like. The ISA lists the parts by audience: asset owners, automation product suppliers, integrators and service suppliers.
| Part | Title (ISA listing) | Typical regulatory use |
|---|---|---|
| 62443-2-1 | Security program requirements for IACS asset owners | Evidence for NIS2 Article 21 measures at plant level |
| 62443-2-4 | Security program requirements for IACS service providers | Supplier assurance under NIS2 Article 21(2)(d); integrator capability |
| 62443-3-2 | Security risk assessment for system design | Zones and conduits risk assessment feeding both NIS2 and machine risk assessment |
| 62443-3-3 | System security requirements and security levels | Target security levels for a line or machine control system |
| 62443-4-1 | Secure product development lifecycle requirements | Evidence of secure development and vulnerability handling for CRA |
| 62443-4-2 | Technical security requirements for IACS components | Component capabilities such as authentication, integrity and logging |
See the IEC 62443-2-1 Asset Owner Security Programme Guide and the IEC 62443-4-1 and 4-2 Secure Product Development Guide. Whether a given CRA harmonised standard draws on IEC 62443 is a standardisation question still in progress, so check the harmonised standards guide rather than assuming 62443 certification equals CRA conformity.
Timeline and current status
| Date | Event |
|---|---|
| 14 June 2023 | Machinery Regulation adopted |
| 17 October 2024 | NIS2 transposition deadline; national measures to apply from 18 October 2024 |
| 10 December 2024 | CRA enters into force |
| 11 June 2026 | CRA Chapter IV, notification of conformity assessment bodies, applies |
| 11 September 2026 | CRA Article 14 reporting of actively exploited vulnerabilities and severe incidents applies |
| 20 January 2027 | Machinery Regulation applies; machinery placed on the market before then follows the Machinery Directive |
| 11 December 2027 | CRA main obligations apply |
What it means for AI agents and non-human identities
- Remote maintenance identities: OEM and integrator service accounts that reach machines are a supply chain relationship under NIS2 Article 21(2)(d) and a route for the corruption the Machinery Regulation asks you to prevent. Give each a named owner, MFA where the path allows it, and time-bound access. See the OT Remote Access Guide.
- Update signing keys: the key that signs firmware or safety software is the control behind CRA secure updates and the Machinery Regulation's tracing of uploaded safety software versions. Store it in hardware, restrict who can trigger signing, and log every use.
- Device identities: certificates and keys embedded in PLCs, gateways and sensors need a lifecycle that matches the declared CRA support period. See the Device and IoT Identity Guide.
- Self-evolving logic: machine learning safety components are an Annex I Part A category under the Machinery Regulation, so the service identities that retrain or push models to them belong in the safety case.
Compliance steps
- Map your roles. For each legal entity and product line, record whether you are an operator, product maker, machine builder, modifier, importer or distributor, using the role table above.
- Confirm NIS2 status per country. Check your NACE codes and size against each national law where you have establishments, and register where required.
- Classify products. List every product with digital elements, decide its CRA class and support period, and identify machines that also fall under the Machinery Regulation.
- Stand up one reporting desk. Route NIS2 incidents and CRA exploited vulnerabilities through one triage process with two distinct clocks and recipients.
- Define substantial modification internally. Write a rule for when a retrofit, new connectivity or control software change triggers a new conformity assessment, and apply it to integrators by contract.
- Align evidence to IEC 62443. Use 2-1 at plant level, 2-4 for service providers and 4-1 and 4-2 for products, so one evidence set serves several regulators and customers.
- Assign owners for moving dates. National NIS2 laws, CRA harmonised standards and Machinery Regulation harmonised standards will keep changing through 2027.
Common failure patterns
- Treating the CRA as an IT product law: component makers assume industrial products are out of scope, but Article 2 has no industrial exclusion.
- Forgetting the modifier rule: plants add remote connectivity to legacy machines and do not realise they may have taken on manufacturer duties.
- Two threat models for one machine: safety and product security teams run separate assessments that disagree on the same attack paths.
- One clock for everything: an incident process built for NIS2 misses the CRA early warning for a vulnerability being exploited in customers' products.
- Shared vendor accounts: generic OEM logins on HMIs and remote access gateways undermine both the access control measure in NIS2 and the evidence of intervention the Machinery Regulation expects.
Practitioner checklist
- Record every manufacturer role your organisation plays, per entity and product line.
- Confirm NIS2 classification and registration in each Member State where you operate.
- Classify products under CRA Annex III and IV and declare support periods.
- Identify machines that need both Machinery Regulation and CRA evidence, and keep one technical file.
- Run one incident and vulnerability triage with NIS2 and CRA clocks side by side.
- Write and enforce a substantial modification rule for retrofits and integrators.
- Inventory remote maintenance accounts, signing keys and device certificates with owners.
- Map evidence to IEC 62443 parts by role.
Standards and references
- EUR-Lex: Directive (EU) 2022/2555 (NIS2)
- EUR-Lex: Regulation (EU) 2024/2847 (Cyber Resilience Act)
- EUR-Lex: Regulation (EU) 2023/1230 on machinery
- European Commission: Machinery
- European Commission: Cyber Resilience Act
- ISA: ISA/IEC 62443 Series of Standards
Related NHI Mgmt Group resources: Manufacturing Cybersecurity Programme Guide · NIST CSF Manufacturing Profile Guide · NIS2 vs Cyber Resilience Act · Critical Infrastructure Regulation Map. This guide summarises manufacturing cyber security regulation in the EU and is not legal advice.