CRA vs the Machinery Regulation

What is different

• Primary concern: the Machinery Regulation is about physical safety — the machine must not injure people; the CRA is about cybersecurity — the product's digital elements must resist compromise.
• Scope of subject matter: the Machinery Regulation covers machinery and related products as defined in its annexes; the CRA covers products with digital elements broadly, machinery or not.
• Historical basis: the Machinery Regulation replaces and updates the Machinery Directive 2006/42/EC, extending it to address digital risks explicitly for the first time; the CRA is new horizontal cybersecurity legislation.
• Conformity route: machinery conformity assessment follows established Notified Body and self-certification routes tied to machinery categories in the annexes; CRA conformity assessment routes depend on the product's risk classification under the CRA.

What overlaps

The Machinery Regulation was updated specifically to recognise that a cybersecurity compromise of a safety-related control system can create a physical safety hazard — for example, a manipulated sensor signal disabling a guard interlock. Where a cybersecurity vulnerability could lead to a hazardous situation, machinery safety requirements and CRA-relevant secure-design practice converge on the same root cause: the integrity of the safety-related control function.

Both frameworks expect a documented risk assessment, a technical file, and a declaration of conformity supported by evidence. Where a machine's safety function depends on software or network communication, the risk assessment, secure architecture and verification evidence built for CRA purposes should feed directly into the machinery risk assessment rather than being produced twice.

Which applies to you

• You build machinery with no meaningful digital elements affecting safety: the Machinery Regulation applies; CRA relevance is limited or absent.
• You build machinery with connectivity, remote monitoring or software-based safety functions: both apply, and the interaction between cybersecurity risk and safety risk should be assessed together, not as separate silos.
• You supply a connected component (a sensor, drive or controller) into someone else's machine: you may have CRA obligations as a manufacturer of a product with digital elements, while your customer carries the machinery-level obligations for the finished machine.
• You are updating an existing machine design to add connectivity: treat this as triggering both a machinery risk re-assessment and a CRA scoping exercise, since either can change your conformity route.

Frequently asked questions