EU Machinery Regulation & Cyber Resilience Act: Changes from 2027

New Regulations EU Machinery Regulation And Cyber Resilience Act: What Manufacturers Need to Consider Now

2025-11-04 Source: Press release TÜV Austria | Translated by AI 1 min Reading Time

Related Vendors

tmts2026-ticec-banner-en-2000px (https://www.tmts.tw/en)

Taiwan Machine Tool & Accessory Builders' Association (TMBA)

With the new EU Machinery Regulation and the Cyber Resilience Act, mandatory legal requirements will apply to manufacturers of machines and digital products starting in 2027. Both regulations aim to enhance safety within the European internal market but focus on different priorities.

Dr.-Ing. Christian Geiss, founder and managing director of Clockwork X GmbH—a subsidiary of the TÜV Austria Group—presents "Cyber Resilience Act Live" at Cadfem on November 4, 2025, in Salzburg.(Image: Clockwork X / TÜV Austria) — Dr.-Ing. Christian Geiss, founder and managing director of Clockwork X GmbH—a subsidiary of the TÜV Austria Group—presents "Cyber Resilience Act Live" at Cadfem on November 4, 2025, in Salzburg.
(Image: Clockwork X / TÜV Austria)

The EU Machinery Regulation focuses on the mechanical, electrical, and functional safety of machinery and safety-related components. For the first time, digital risks are also taken into account, such as those posed by artificial intelligence or human-robot collaboration. Manufacturers are required to conduct a comprehensive risk assessment, create technical documentation, and provide a CE marking as well as a declaration of conformity. The regulation will enter into force on January 20, 2027.

The Cyber Resilience Act (CRA), on the other hand, exclusively addresses products with digital elements such as software, IoT devices, or connected controls. The aim is to protect these products against cyberattacks. Manufacturers must implement security measures such as "Security by Design," active vulnerability management, regular security updates, and reporting obligations. Here too, the transition period ends in early 2027.

Dual Obligation for Machines With Digital Components

The dual obligation is particularly relevant for manufacturers of machines with digital components. They must meet the requirements of both the Machinery Regulation and the Cyber Resilience Act to continue placing their products on the EU market in compliance with the law after 2027.

To provide support, TÜV Austria, together with its cybersecurity specialist Clockwork X GmbH, offers a practical CSMS Masterclass, where companies can learn how to establish a Cybersecurity Management System that complies with the new EU regulations. Additionally, Dr.-Ing. Christian Geiss, founder and managing director of Clockwork X GmbH, will deliver a lecture at the Cadfem Conference Salzburg (Austria) on November 5, 2025, on how to efficiently implement and demonstrate cybersecurity requirements in products and machinery.

Subscribe to the newsletter now

Don't Miss out on Our Best Content

Business E-mail

Please enter a valid mailadress.

By clicking on „Subscribe to Newsletter“ I agree to the processing and use of my data according to the consent form (please expand for details) and accept the Terms of Use. For more information, please see our Privacy Policy. The consent declaration relates, among other things, to the sending of editorial newsletters by email and to data matching for marketing purposes with selected advertising partners (e.g., LinkedIn, Google, Meta)

Date: 08.12.2025

Naturally, we always handle your personal data responsibly. Any personal data we receive from you is processed in accordance with applicable data protection legislation. For detailed information please see our privacy policy.

Consent to the use of data for promotional purposes

I hereby consent to Vogel Communications Group GmbH & Co. KG, Max-Planck-Str. 7-9, 97082 Würzburg including any affiliated companies according to §§ 15 et seq. AktG (hereafter: Vogel Communications Group) using my e-mail address to send editorial newsletters. A list of all affiliated companies can be found here

Newsletter content may include all products and services of any companies mentioned above, including for example specialist journals and books, events and fairs as well as event-related products and services, print and digital media offers and services such as additional (editorial) newsletters, raffles, lead campaigns, market research both online and offline, specialist webportals and e-learning offers. In case my personal telephone number has also been collected, it may be used for offers of aforementioned products, for services of the companies mentioned above, and market research purposes.

Additionally, my consent also includes the processing of my email address and telephone number for data matching for marketing purposes with select advertising partners such as LinkedIn, Google, and Meta. For this, Vogel Communications Group may transmit said data in hashed form to the advertising partners who then use said data to determine whether I am also a member of the mentioned advertising partner portals. Vogel Communications Group uses this feature for the purposes of re-targeting (up-selling, cross-selling, and customer loyalty), generating so-called look-alike audiences for acquisition of new customers, and as basis for exclusion for on-going advertising campaigns. Further information can be found in section “data matching for marketing purposes”.

In case I access protected data on Internet portals of Vogel Communications Group including any affiliated companies according to §§ 15 et seq. AktG, I need to provide further data in order to register for the access to such content. In return for this free access to editorial content, my data may be used in accordance with this consent for the purposes stated here. This does not apply to data matching for marketing purposes.

Right of revocation

I understand that I can revoke my consent at will. My revocation does not change the lawfulness of data processing that was conducted based on my consent leading up to my revocation. One option to declare my revocation is to use the contact form found at https://contact.vogel.de. In case I no longer wish to receive certain newsletters, I have subscribed to, I can also click on the unsubscribe link included at the end of a newsletter. Further information regarding my right of revocation and the implementation of it as well as the consequences of my revocation can be found in the data protection declaration, section editorial newsletter.