Security by design
Essential requirements (Annex I): secure configuration by default, no known exploitable vulnerability when placed on the market.
Cyber Resilience Act
CRA: turn an obligation into a product advantage.
European Regulation (EU) 2024/2847 sets cybersecurity requirements for all products with digital elements sold in the Union. Step AT supports manufacturers of connected machines and industrial equipment, from gap analysis to preparing technical documentation.
Key dates
Reporting obligations already apply.
| Date | What applies |
|---|---|
| 10 Dec 2024 | Entry into force of Regulation (EU) 2024/2847. |
| 11 Jun 2026 | Application of the provisions on the notification of conformity assessment bodies. |
| 11 Sep 2026 | Reporting obligations for manufacturers: actively exploited vulnerabilities and severe incidents, via the single reporting platform run by ENISA. Early warning within 24 h, notification within 72 h, then a final report. They also cover products already on the market. |
| 11 Dec 2027 | Full application: essential cybersecurity requirements, conformity assessment, EU declaration and CE marking. |
General information, not legal advice. Step AT is neither a notified body nor a law firm: check your situation against the official text and with your advisers.
What the CRA requires of manufacturers
Six points that directly affect engineering.
SBOM
A bill of materials for software components, in a common machine-readable format, kept up to date.
Vulnerability handling
A process to identify, document, fix and disclose flaws, with security updates provided throughout the support period (five years by default).
Our VDP policyReporting
Reporting of actively exploited vulnerabilities and severe incidents to ENISA and the competent CSIRT, within 24 h and 72 h deadlines.
Documentation and conformity
Technical documentation kept for ten years, conformity assessment, EU declaration of conformity and CE marking.
Penalties
Up to 15 million euros or 2.5% of annual worldwide turnover for breaches of the essential requirements and manufacturer obligations.
Why industry is concerned
A connected machine is a digital product.
As soon as equipment embeds software and a data connection, direct or indirect, it falls within the scope of the regulation. For a manufacturer of machines, controllers or measurement systems, this covers the firmware, the embedded application, the data gateway and their updates. The CRA targets the product placed on the market. NIS 2 targets operation at the operator, and the IEC 62443 standard provides a recognized good-practice framework for both.
UDS Atom
A data gateway designed with this in mind.
UDS Atom is developed following a Security by Design approach. We are working toward its compliance with CRA requirements, and its security building blocks can serve as a foundation for your own products.
SBOM CycloneDX
Component register generated for every release.
RBAC and JWT
Role-based access, signed tokens, separation of rights.
TLS 1.3
Encrypted communications between components and to the outside.
Signed plugins
PPL plugins cryptographically signed, managed PGP keys.
Our support
From scoping to technical documentation.
- Scoping and classificationWhich products are concerned, which economic role, which category (default, important or critical) and therefore which conformity procedure.
- Gap analysisComparison of your products and processes with the requirements: support period, vulnerability handling, documentation.
- Technical implementationSBOM, authentication and access control, encryption, signed updates, hardening of your LabVIEW, CompactRIO and Linux RT applications.
- Vulnerability and reporting processProcedures and tools to meet the 24 h and 72 h deadlines and to publish fixes.
- Conformity preparationTechnical documentation and evidence for your conformity assessment, with your notified body if your product requires it.
Frequently asked questions
The questions we hear most.
Is my product concerned?
If your product contains software and can connect, directly or indirectly, to a device or a network, and you place it on the European market, the answer is very likely yes. Some regulated sectors (medical devices, automotive, civil aviation) fall under other texts.
Are products already sold concerned?
The reporting obligations applicable since 11 September 2026 also cover products already on the market. The essential requirements apply to products placed on the market from 11 December 2027.
Do I need a third party?
For most products, a self-assessment is enough. "Important" or "critical" products require third-party assessment or certification. Classification depends on the product's core function.
Where do I start?
With an inventory of your connected products and their software components. It is the basis for scoping, gap analysis and the SBOM.