TÜV certified EUCHNER's CRA business and development processes. This means that the steps taken by EUCHNER to comply with the Cyber Resilience Act in 2027 are the right ones.
Modern “smart” safety components transmit data to and receive data from controllers. This data must be resilient against intrusion by malicious actors. These components certainly include key systems (Electronic Key Systems) used for authorization, as well as smart door locks on industrial bus systems (ProfiNet, EtherNet, EtherCat). Transponder-coded safety switches that only provide OSSD signals on the user side do not transmit data and fall outside the scope of the CRA.
Malicious software specialists attempt to infiltrate operating systems to either create chaos or hold systems hostage for payment. The 27 countries of the European Union have established the CRA Act to curb these risks.
Data must be protected against unintended external influences. Data encryption is, of course, a first-line solution. However, human behavior also plays a major role here. Data security is set by people and can therefore also be undone by people. The CRA therefore compels making internal business processes, which are only indirectly related to products, resilient as well.
All measures to be taken and measures already taken must be secured and documented. Once everything is in order, you can be certified by a 'notified body'. Product buyers want to see and receive such certificates, because only with such a guarantee can they build a finished product that must also be CRA-certified.
There are components that cannot obtain a CRA certificate yet may still be supplied. This concerns retrofit parts, but also parts that pose no risk in a finished product. The builder of the finished product (machine) must assess and document this.
You might think that CRA implications only apply within the EU. However, if you are a machine manufacturer outside the EU and want to supply your products within the EU, the CRA applies to those products as well. This makes things considerably more difficult for suppliers outside the EU who wish to supply within the EU.
The CRA is stringent legislation. Limiting the success of cybercriminals necessitates severe measures. This legislation may be adopted in countries outside the EU, as cyberattacks are a global problem.
Naturally, the CRA extends deeper than just machine building. Consider how many essential organizations are vulnerable: hospitals, transport companies, car manufacturers, energy companies, and so on. Complying with the CRA is a considerable task. But it is urgently needed.
The CRA is a regulation, so it will enter into force immediately throughout the EU.
As of September 11, 2026, manufacturers are required to report actively exploited vulnerabilities and serious incidents.
As of December 11, 2027, the CRA Act will be fully applicable. From then on, all hardware and software with digital elements must meet strict security requirements (security-by-design).