Reporting obligations concerning actively exploited vulnerabilities and severe cybersecurity incidents under the European Union’s Cyber Resilience Act came into effect on 11 September 2026. The regulation’s main provisions will apply from 11 December 2027, affecting various aspects of woodworking machinery within its scope, from control systems and software updates to technical documentation and after-sales support.

The European Union is gradually implementing new regulations aimed at strengthening the cybersecurity of products with digital elements. Regulation (EU) 2024/2847, known as the Cyber Resilience Act (CRA), was adopted by the European Parliament and the Council on 23 October 2024 and establishes cybersecurity requirements for hardware and software products with digital elements.

Published in the Official Journal of the European Union on 20 November 2024 and entering into force on 10 December 2024, the regulation is not limited to computers and software. Under Article 2, products with digital elements whose intended purpose or reasonably foreseeable use includes a direct or indirect data connection to a device or network fall within its scope, subject to the exceptions specified in the regulation.

In this context, woodworking machines equipped with digital control systems, data connections or remote servicing capabilities may also be affected. For production systems such as CNC machining centres, panel sizing machines and edge banding lines, the applicability of the CRA must be assessed based on each product’s technical characteristics and conditions of use.

Under What Conditions Does Woodworking Machinery Fall Within the Scope?

One of the determining factors under the CRA is whether a product’s intended purpose or reasonably foreseeable use involves a data connection.Machines connected to factory networks via Ethernet or Wi-Fi, as well as production systems that allow remote technical servicing, are among the examples that need to be assessed under the regulation. The regulation does not focus exclusively on internet connections. Physical data connections and indirect connections established through other devices or systems are also taken into account when determining its scope. Accordingly, control systems capable of transferring data through USB, SD cards or service interfaces must also be assessed according to the nature of their connections and their intended use. Conversely, products without data connections of the kind defined by the regulation may fall outside its scope. Therefore, it cannot be assumed that all woodworking machines are automatically subject to the same CRA obligations.

What Cybersecurity Obligations Will Manufacturers Face?

Article 13 and Annex I of the CRA establish the essential cybersecurity requirements and manufacturers’ responsibilities for products within its scope. Once the main provisions become applicable, manufacturers will be required to carry out cybersecurity risk assessments for their products and take the results into account throughout the design, development, production, delivery and maintenance phases.

The regulation requires products to be designed and manufactured with a level of cybersecurity appropriate to the risks, to be placed on the market without known exploitable vulnerabilities, and to incorporate applicable security measures based on their risk assessments. The requirements set out in Annex I include secure-by-default configurations, protection against unauthorised access, protection of data and command integrity, limitation of attack surfaces, and secure delivery of security updates. The application of these requirements is determined by the scope of the relevant provisions and the product’s cybersecurity risk assessment.

Manufacturers are also required to prepare technical documentation, complete the applicable conformity assessment procedures, and fulfil the relevant EU declaration of conformity and CE marking requirements. The applicable conformity assessment procedure may vary depending on the product’s classification under the CRA.

Cybersecurity Requirements Must Also Be Considered Under the New Machinery Regulation

Another important piece of legislation is Regulation (EU) 2023/1230 on machinery, which will generally apply from 20 January 2027. While the Machinery Regulation establishes essential health and safety requirements for machinery, it also addresses safety risks arising from digital systems. The CRA regulates cybersecurity for products with digital elements within its scope through a broader framework.

Recital 53 of the CRA clarifies the relationship between the two regulations. According to this recital, compliance with the CRA’s essential cybersecurity requirements may contribute to meeting the relevant requirements of Sections 1.1.9 and 1.2.1 of Annex III to the Machinery Regulation. However, manufacturers must demonstrate this relationship and complete the applicable conformity assessment procedures under both regulations.

Provisions Directly Relevant to Machinery

Protection Against Corruption – Annex III, Section 1.1.9

Section 1.1.9 of the Machinery Regulation requires that connecting another device to machinery must not lead to a hazardous situation. The section requires hardware components that transmit signals or data for connection to, or access to, software critical for compliance with the relevant essential health and safety requirements to be adequately protected against accidental or intentional corruption. It also establishes requirements for collecting evidence of legitimate or illegitimate interventions involving these components. The identification and protection of software and data critical for compliance with essential health and safety requirements against accidental or intentional corruption are also covered. Software necessary for the safe operation of machinery must be identifiable, and this information must be readily accessible at all times. The requirements also include collecting evidence of interventions and modifications involving the software or its configuration.

Safety and Reliability of Control Systems – Annex III, Section 1.2.1

Section 1.2.1 of the Machinery Regulation requires control systems to be designed and constructed in a way that prevents hazardous situations from arising.

In particular, Section 1.2.1(a) requires control systems to withstand intended operating stresses and intended and unintended external influences, taking into account the circumstances and risks involved.

These external influences include reasonably foreseeable malicious attempts by third parties that could lead to a hazardous situation.

Section 1.2.1(f) also establishes a specific requirement concerning the tracking of data relating to interventions occurring after machinery has been placed on the market or put into service, as well as versions of safety software uploaded.

These tracking records must remain enabled for five years after the relevant upload and must be used exclusively to demonstrate conformity with Annex III in response to a reasoned request from a competent national authority.

What Technical Aspects Should Woodworking Machinery Manufacturers Consider?

These provisions highlight the importance of assessing how digital connections and control software may affect the physical safety of machinery.

Depending on product characteristics and risk assessments, the technical areas that woodworking machinery manufacturers may need to examine include:

  • Protection of control software: Identifying risks of unauthorised interference with CNC controllers, human-machine interfaces and safety-related software.
  • Access management: Assessing access permissions for operators, maintenance personnel and remote service users.
  • Data and command integrity: Protecting cutting programs, operating parameters and safety-related configurations against unauthorised modifications.
  • Connection security: Identifying risks associated with network, USB and service connections and assessing appropriate protective measures.
  • Software updates: Ensuring that updates are carried out securely and examining their potential effects on the safe operation of machinery.
  • Control system resilience: Assessing the potential impact of cybersecurity incidents on machine control and safety-related functions.

These areas represent examples of how the risk-based requirements in the legislation may be applied to woodworking machinery.

They do not mean that every measure must be implemented in the same way across all types of machinery. Appropriate measures must be determined according to the applicable legal requirements, product characteristics and risk assessment results.

How Are Security Updates and Support Periods Regulated?

Article 13(8) of the CRA requires manufacturers to determine a support period that reflects the expected time a product will be in use. As a general rule, the support period must be at least five years. However, where the expected lifetime of a product is shorter than five years, the support period must correspond to that expected lifetime. Recital 60 of the regulation highlights that products with digital elements intended for industrial environments, such as industrial control systems, are often used for considerably longer periods. Under Article 13(9), security updates made available to users during the support period must remain available for at least 10 years from their release or for the remainder of the support period, whichever is longer. Point 8 of Part II of Annex I also requires security updates addressing identified security issues to be distributed without delay and made available free of charge, together with relevant information. An exception applies to products with digital elements that are tailor-made for a particular business user, where different conditions have been agreed between the manufacturer and that business user. The regulation also requires manufacturers to establish processes for identifying, documenting and addressing vulnerabilities. Part II of Annex I includes a requirement to prepare a Software Bill of Materials (SBOM), identifying software components and at least their top-level dependencies.

Cybersecurity Reporting Obligations Took Effect on 11 September 2026

The reporting obligations established under Article 14 of the CRA became applicable on 11 September 2026. These provisions require manufacturers to report actively exploited vulnerabilities in products with digital elements and severe incidents having an impact on the security of such products. Manufacturers must submit an early warning without undue delay and no later than 24 hours after becoming aware of a reportable vulnerability or incident. A more detailed notification must follow within 72 hours. For actively exploited vulnerabilities, a final report must be submitted no later than 14 days after a corrective or mitigating measure becomes available. For severe incidents affecting product security, the final report must be submitted no later than one month after the 72-hour incident notification. Notifications are submitted through the CRA Single Reporting Platform established by the European Union Agency for Cybersecurity (ENISA). They are directed to the relevant coordinator Computer Security Incident Response Team (CSIRT) in accordance with the jurisdictional rules laid down in Article 14. Information is shared with ENISA and the relevant CSIRTs of other Member States according to the procedures and exceptions established by the regulation. Importantly, these reporting obligations are not limited to products placed on the market after 2027. Under Article 69(3) of the CRA, the reporting obligations also apply to products with digital elements within its scope that were placed on the EU market before 11 December 2027.

Modernisation and Substantial Modification of Existing Machinery

Under Article 69(2) of the CRA, products with digital elements placed on the market before 11 December 2027 are generally not subject to the regulation’s main product conformity requirements unless they undergo a substantial modification after that date. However, the reporting obligations established under Article 14 are excluded from this transitional provision. The concept of substantial modification, defined in Article 3 of the CRA, concerns changes made after a product has been placed on the market that affect its compliance with the essential cybersecurity requirements set out in Part I of Annex I or change the intended purpose for which the product was assessed. Therefore, modernisation activities such as installing a new controller, connectivity module or remote access system in existing machinery must be assessed according to the nature of the modification and the relevant cybersecurity requirements. Article 22 establishes the conditions under which manufacturer obligations apply to natural or legal persons carrying out substantial modifications to products with digital elements. Not every maintenance operation, repair or software update automatically constitutes a substantial modification.

Supplied Software and Components Also Require Attention

Controllers, human-machine interfaces, networking equipment, operating systems and other software components used in woodworking machinery play an important role in assessing product cybersecurity. Article 13(5) of the CRA requires manufacturers to exercise due diligence when integrating components sourced from third parties into their products, ensuring that these components do not compromise the cybersecurity of the final product. In this context, it is important to assess the vulnerabilities, update capabilities and support periods of integrated components. Monitoring technical information obtained from suppliers and security update processes is also among the areas manufacturers may consider as part of their compliance preparations.

European Commission Publishes Implementation Guidance

On 27 July 2026, the European Commission published guidance on the implementation of the Cyber Resilience Act. The guidance provides explanations concerning product scope, substantial modifications, support periods, risk assessments and reporting obligations. It also includes examples addressing situations that micro, small and medium-sized enterprises may encounter during implementation. The European Commission states that the guidance is not legally binding. Manufacturers must therefore rely on the relevant provisions of the regulation as the legal basis while using the guidance as an explanatory resource for implementation.

A New Compliance Timeline for Manufacturers

Two important dates stand out for woodworking machinery manufacturers. The new Machinery Regulation will generally apply from 20 January 2027, while the main obligations under the Cyber Resilience Act will apply from 11 December 2027. Meanwhile, reporting obligations relating to actively exploited vulnerabilities and severe incidents affecting product security have been in effect since 11 September 2026. This timeline highlights the importance of manufacturers placing machinery on the EU market reviewing product scope, control system security, software components, risk assessments, technical documentation and reporting procedures in accordance with the applicable legislation. The CRA integrates cybersecurity into product design, conformity assessment and after-sales support processes for products with digital elements within its scope. For woodworking machinery manufacturers, the central challenge in the coming period will be to assess compliance with applicable regulatory requirements based on each product’s technical characteristics and conditions of use.