Since 11 September 2026, manufacturers of products with digital elements sold in the EU have had a legal duty to notify actively exploited vulnerabilities. The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, says in Article 71 that Article 14 applies from that date, while the rest of the Regulation applies from 11 December 2027.
If you make a smart machine, the CRA is one of three regulations that land on the same product. The other two are the Machinery Regulation, Regulation (EU) 2023/1230, and the AI Act, Regulation (EU) 2024/1689. This post sorts out what binds, what is guidance, and which date applies to which duty. It is a reading guide, not legal advice. Check the Official Journal text and your notified body.
Safeguard does not make machines safe and does not certify conformity. Its relevant strengths here are SBOMs, vulnerability tracking and records.
What's affected
A product that is machinery, includes software and uses machine learning for safety functions can fall under all three.
| Regulation | Applies from | Core idea |
|---|---|---|
| Machinery Regulation (EU) 2023/1230 | 14 January 2027 (Article 54) | Health and safety requirements, including protection against corruption and safe control systems |
| CRA (EU) 2024/2847 | 11 December 2027, with Article 14 from 11 September 2026 | Cybersecurity requirements and vulnerability handling for products with digital elements |
| AI Act (EU) 2024/1689 | Staged. High risk product rules moved by Regulation (EU) 2026/1744 | Requirements for high risk AI systems |
The AI Act's original text applied Article 6(1), the high risk rule for AI that is a safety component of a product under Annex I legislation, from 2 August 2027. The Digital Omnibus on AI, Regulation (EU) 2026/1744, dated 8 July 2026 and in force from 27 July 2026, moves it to 2 August 2028 for systems classified under Article 6(1) and Annex I, and to 2 December 2027 for Annex III systems.
Binding or guidance
Binding:
- The regulation text, including the Annexes. Machinery Annex III, section 1.1.9 on protection against corruption requires software critical for safety compliance to be "identified as such" and "adequately protected against accidental or intentional corruption," and requires the machine to "identify the software installed on it that is necessary for it to operate safely."
- Section 1.2.1 requires control systems to withstand "reasonably foreseeable malicious attempts from third parties leading to a hazardous situation," and sets logging periods: five years for the intervention and safety software version log and one year for decision data on self evolving safety systems.
- Annex I, Part A of the Machinery Regulation lists "safety components with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions" and machinery embedding such systems, which go to third party conformity assessment.
- CRA Annex I, Part II, point 1: identify and document vulnerabilities and components, "including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies."
- CRA Article 14: for an actively exploited vulnerability, an early warning "within 24 hours of the manufacturer becoming aware of it," a vulnerability notification within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure is available.
Guidance, not law:
- Recitals. CRA recital 53 says compliance with the CRA's essential requirements "could facilitate" compliance with Machinery sections 1.1.9 and 1.2.1, and that the manufacturer has to demonstrate these synergies. It says the CRA does not replace the machinery requirements: manufacturers "should comply with both."
- Harmonised standards. Machinery Article 20 says a product in conformity with harmonised standards whose references are published in the Official Journal "shall be presumed to be in conformity" with the Annex III requirements those standards cover. That is a route to presume conformity, not a duty to use a given standard.
- Commission notices, FAQs and similar documents, such as the Blue Guide cited in the AI Act recitals. They show how the Commission reads the text. They do not create duties.
How to check your position
- Is your product machinery or a related product under the Machinery Regulation? If yes, Annex III applies from 14 January 2027, and Directive 2006/42/EC is repealed from the same date (Article 51).
- Is it a product with digital elements? If yes, the CRA applies from 11 December 2027, and Article 14 reporting already applies.
- Does it use machine learning for a safety function? If yes, check Annex I, Part A of the Machinery Regulation and Article 6(1) of the AI Act, with the dates above.
- Do you have an SBOM per release, a vulnerability intake and a 24 hour reporting path? That is already required for the CRA.
What to do now
- Set up the 24 and 72 hour clocks. Name who decides a vulnerability is actively exploited and who files. Rehearse once.
- Generate an SBOM for each release, covering more than the top level if you can.
- Mark software that is critical for safety in your design records, as section 1.1.9 requires.
- Add the logs described in section 1.2.1 to your architecture review.
- Decide whether any ML feature ensures a safety function. If it does, plan third party assessment time into the schedule.
- Track which harmonised standards are cited in the Official Journal for each regulation, since that decides what you can use to presume conformity.
Why it matters
The dates stagger, but the work overlaps. A single SBOM, a single vulnerability intake process and a single set of logs support the Machinery Regulation, the CRA and the AI Act at once. Treat them as one engineering programme with three deadlines, not three projects.
The first deadline is already past. Article 14 of the CRA applies, and the 24 hour early warning clock runs from the moment you become aware of an actively exploited vulnerability in a product you placed on the market.
Try it yourself
List your product, mark which of the three regulations apply, and write the date each starts to bind. The walkthrough shows how AI Act duties and dates are sorted.
Click through it at your own pace, or open it full screen.
Quick check
Which CRA provision already applies in 2026?
Article 14, the reporting obligations for actively exploited vulnerabilities and severe incidents, which applies from 11 September 2026. The rest of the CRA applies from 11 December 2027.
Does the CRA replace the Machinery Regulation's cybersecurity requirements?
No. Recital 53 says manufacturers must comply with both, and that CRA compliance could facilitate compliance with Machinery Annex III sections 1.1.9 and 1.2.1 if the manufacturer demonstrates the synergies.
Is a harmonised standard mandatory?
No. Conformity with a cited harmonised standard gives a presumption of conformity for the requirements it covers (Machinery Article 20). It is an option.
