Don't Procrastinate

Cybersecurity Don't Procrastinate

2025-06-23 From Jan Vollmuth | Translated by AI 4 min Reading Time

Related Vendors

FAULHABER Drive Systems

tmts2026-ticec-banner-en-2000px (https://www.tmts.tw/en)

Taiwan Machine Tool & Accessory Builders' Association (TMBA)

Wuxi InfiMotion Technology Co., Ltd.

The Machinery Regulation and the Cyber Resilience Act will apply from 2027 and are intended to strengthen cybersecurity in the EU. The new regulations pose major challenges for companies, which they should already begin to address today.

The requirements of the Machinery Regulation and the Cyber Resilience Act will significantly change the product development process.(Image: © Sikov – stock.adobe.com) — The requirements of the Machinery Regulation and the Cyber Resilience Act will significantly change the product development process.
(Image: © Sikov – stock.adobe.com)

The numbers are alarming: According to the industry association Bitkom, cyberattacks such as ransomware, phishing, and other digital attacks cause damage of around 191 billion dollars to the German economy annually, with the total damage from cybercrime amounting to 285 billion dollars in 2024. Two-thirds of German companies (65 percent) see their existence threatened by a successful cyberattack, according to Bitkom.

For all of Europe, there is no unified official total sum for the damage caused by cybercrime in 2024. However, the available figures from Germany—as Europe's largest economy—illustrate the scale. Since similar threats and attack patterns also occur in other European countries, it can be assumed that the Europe-wide damage from cybercrime in 2024 is significantly higher than this value.

Enhanced Protection Against Cybercrime

Against this backdrop, the European Union has decided to supplement the new Machinery Regulation (EU) 2023/1230 with specific cybersecurity requirements for machinery and their digital components. This reflects the EU's acknowledgment of the trend that modern machines are increasingly networked and use software-driven safety functions. However, the MVO still focuses primarily on the physical and functional safety of machines and their components. It replaces the previous Machinery Directive 2006/42/EC and will come fully into force on January 20, 2027.

The requirements of the Machinery Regulation

Specifically, Annex III—1.1.9 of the new MVO, which comes into force on January 20, 2027, focuses on protection against corruption: the connection or communication with "another device" must not create dangerous situations. Machines and systems must be designed and built to communicate with other devices or networks without creating security risks. The software for the operation of the machine or system must also be designed to be protected against manipulation, for example, through the use of encryption technologies, security protocols, and regular software updates. These requirements apply to both manufacturers of machines and safety components as well as operators.

To regulate the cybersecurity of products with digital elements, the European Union has adopted the Cyber Resilience Act (CRA), which already came into force on December 10, 2024. The CRA defines access requirements for the EU internal market and extends the scope of the CE marking. It is applicable from December 2027, but there is already a reporting obligation for cybersecurity vulnerabilities of a product starting from September 2026.

The CRA defines cybersecurity requirements independent of product category to protect digital products throughout their entire lifecycle. Manufacturers must take responsibility for the IT security of their products beyond the point of sale. This applies to virtually all connected or connectable products: from vacuum robots to software and products used in critical sectors. This obligation is mandatory not only when the product is placed on the market but also throughout its usual lifespan.

The Cyber Resilience Act

The Cyber Resilience Act (CRA) applies to all products that are directly or indirectly connected to another device or network, encompassing both hardware and software. The protection extends across the entire product lifecycle: from planning, design, and development to maintenance of the products. These obligations apply to all stages of the value chain. From the full enactment of the CRA in December 2027, products with the CE marking indicate compliance with the legislation's protection objectives. This enables users of the products to subsequently derive further measures to enhance cybersecurity. Some regulations, such as the designation of conformity assessment bodies, come into force on June 11, 2026.

In the Future, Two Sets of Rules Will Be Decisive

Thus, the MVO and the CRA complement each other: while the MVO ensures the mechanical and functional safety of machines, the CRA ensures that digital components and software are secure against cyberattacks. Both rely on strict manufacturer obligations, conformity assessments, and market surveillance. This also has significant implications for the work of designers and developers: in the future, they must ensure not only mechanical safety but also incorporate cybersecurity into their design and development processes—otherwise, they face substantial fines.

This significantly impacts future product development: for instance, products are required to have Security by Design (security from the outset) and Security by Default (machines must be delivered with secure settings by default). Designers must, therefore, plan security measures against cyberattacks, unauthorized access, and manipulation already in the design phase. Machines with digital control require protected interfaces for secure communication. Additionally, secure update mechanisms are needed for software updates or remote access, and software changes must not create security vulnerabilities. Risk assessment must now consider cyber threats, such as potential hacking attacks on machine controls.

Designing for the future with MVO and CRA

The Machinery Regulation (MVO) and the Cyber Resilience Act (CRA) present significant challenges for manufacturers and operators of machines and systems, as well as suppliers of components and systems. While the MVO becomes legally binding across the EU from 2027, the reporting obligation for existing security vulnerabilities and cyber-attacks on connected components and systems required by the CRA comes into force as early as 2026. This is reason enough for companies to prepare early for the necessary and extensive measures.

The Konstruktionsleiter-Forum SPOTLIGHT, taking place on October 14, 2025, in Würzburg, raises awareness of the requirements and their consequences that companies will face, and demonstrates how they must position their development departments and processes in the future. The early bird catches the worm: those who register by July 15, 2025, will receive an early bird discount.

These are just some examples of how the MVO and the CRA will significantly influence and change product development. Companies and their designers and developers would therefore be well advised to start preparing for the future requirements today. (jv)