MACHINERY REGULATION (EU) 2023/1230 · CYBER RESILIENCE ACT
The Machinery Regulation (EU) 2023/1230 applies from 20 January 2027 and replaces the Machinery Directive. It adds requirements against tampering with software, data and controls. If the machine has a data connection, the Cyber Resilience Act applies on top. We assess for free how far both regulations reach your machine, then implement both in one project.
Quick and free:CRA product checkNo transition period. Every machine placed on the market from 20 January 2027 must meet the new Regulation, even if you have built the type for years.
ReferencesT-Systems · Rowan Legal
Leave your number, I'll call you
Krystof Olik · founder and CEO
Same working day (CET), otherwise the next working morning.
CRA updates by email. Once a month: what changed and what it means for your machines.
We built the CRA compliance platform for T-Systems ourselves, and the CVE watch for your machines runs on our own CRA testing tool.
Annex III section 1.1.9, protection against corruption, explicitly requires protection against tampering for the first time.
Control systems must withstand reasonably foreseeable malicious attempts by third parties that lead to a hazardous situation.
As soon as the machine exchanges data with a device or network: then, as a product with digital elements, it falls under the CRA and must meet both regulations (CRA Art. 2(1) and recital 53).
The Machinery Regulation does not, CRA reporting does.
Both regulations ask for the same building blocks from two angles, and we build each only once.
OFFER
Step 1 · Start here
For one machine type you know how far both regulations reach you and where the main gaps are.
Free
What you get
Step 2
For one machine type: risk assessment, protection concept, logging and documentation for both regulations.
from €9,900excl. VAT, one-off
What you get
Step 3
New vulnerabilities in your machines’ software are triaged before customers ask.
from €390 per monthexcl. VAT
What you get
GUARANTEE
If the risk assessment, protection concept and documentation building blocks are not finished 8 weeks after we receive your input, we keep working at no extra cost until they are. Applies to "Machinery Regulation and CRA in 8 weeks".
Leave your number, I'll call you
Krystof Olik · founder and CEO
Same working day (CET), otherwise the next working morning.
PROCESS
Machine type, controls, interfaces, remote maintenance. No access to code or systems.
In writing: how far the regulations reach you, the main gaps and a fixed price.
Review of software and controls, with your design and software teams, weekly status.
CVE watch, help with reports, documentation upkeep.
REFERENCES
We built the CRA compliance platform for T-Systems: requirements as testable controls, software linked to its git repositories, SBOM and vulnerability matching on every push, triage of new CVEs as OpenVEX.
Our partner law firm for NIS2 and CRA: we do the technical work and prepare processes and documentation, its lawyers validate them and prepare the contracts. We also built AI for the firm that runs on its own servers, with no external APIs.
rowan.legalCONTACT
Within 5 working days of the call you get, in writing, the assessment, the main gaps against both regulations and a fixed price for implementation. No access to code or systems, free, no commitment.
Leave your number, I'll call you
Krystof Olik · founder and CEO
Same working day (CET), otherwise the next working morning.
FAQ
Usually not. Annexes III and IV do not list machines, and integrated components such as a real-time OS or a switch do not change the machine’s class (CRA Art. 7(1)). Self-assessment usually applies.
You, for the machine as a whole. Bought-in components with digital elements, such as a PLC, fall under the CRA at their own manufacturer; you must select and integrate them with due diligence (CRA Art. 13(5)).
Under the Machinery Regulation only for Annex I categories: always for Part A, and for Part B unless you fully apply harmonized standards. Under the CRA only if the core function falls in Annex III or IV.
The initial assessment is free. Implementation for one machine type starts at €9,900 excl. VAT, depending on controls, interfaces and existing documentation. You get the fixed price in writing with the assessment.
No. We are engineers who prepare the concept, implementation and documentation. Third-party assessment is done by a notified body; legal review stays with your counsel, or lawyers at our partner firm Rowan Legal can do it.
Newsletter
The CRA keeps being filled in: Commission guidance, harmonised standards, notified bodies. Once a month, and whenever something important changes, we send a short overview of what changed and what it means for your machines.
MORE SERVICES
