DOES MES, SCADA, OR INDUSTRIAL MACHINERY FALL UNDER THE CYBER RESILIENCE ACT? A TEST FOR MANUFACTURERS
Cyber Resilience Act and MES, SCADA or Machines
See how Cyber Resilience Act relates to MES, SCADA and production machines. Learn what is your obligation and what manufacturer’s.
MES, SCADA, or industrial machinery may fall under the Cyber Resilience Act if they qualify as products with digital elements made available on the EU market and their use involves a direct or indirect data connection to a device or network.
This distinction is already worth keeping in mind. The reporting obligations under Article 14 of the CRA start applying on September 11, 2026, while most of the remaining requirements apply from December 11, 2027.
Do SCADA, MES, and Industrial Machines Fall Under the CRA? First, Define What You Sell
The CRA covers hardware and software classified as products with digital elements. This category may include finished products, components offered independently, and certain remote data processing solutions. A product must be made available on the market and have an intended or reasonably foreseeable data connection to a device or network. For an industrial company, this leads to the following initial assessment:
| Sceranio | What to check |
|---|---|
| 123 | 123 |
| 123 | 123 |
| 123 | 123 |
| 123 | 123 |
| 123 | 123 |
CERT Polska also points out that typical software provided exclusively as SaaS remains outside the scope of the CRA, while software and devices placed on the EU market may be covered.
A similar distinction applies between software developed exclusively for a single organization and a solution supplied to a customer for payment. For industrial equipment, particular attention should be paid to software, communications, and the way the product is made available.
A 5-Question CRA Test for SCADA, MES, and Industrial Machinery
What Is the Product in Your Offering?
Start with the SKU, software version, or machine configuration. Separate the machine, PLC, HMI, firmware, MES or SCADA application, and any components sold independently.
The CRA also covers software and hardware components placed on the market separately. A manufacturer of a complete machine should also know which third-party digital components are included in the product. This information will later be needed for cybersecurity risk assessment and vulnerability handling.
Does the Product Exchange Data With a Device or Network?
No connection to the public Internet does not automatically mean that the CRA does not apply. Article 2 covers direct and indirect, logical and physical data connections to a device or network. A SCADA system communicating only with PLCs inside a closed OT network may therefore still meet this condition.
The person responsible for OT should review interfaces, communication protocols, remote administration, update mechanisms, and dependencies on other systems.
Is the Product Made Available on the Market?
If your company develops its own production reporting tool and uses it exclusively within its own facility, the situation is different from supplying the same software to a customer for payment. The European Commission indicates that products with digital elements not supplied in the course of a commercial activity are not covered by the CRA.
This distinction is particularly relevant for custom MES solutions and applications developed by system integrators.
Are You the Manufacturer, Importer, or Distributor?
The scope of obligations depends on your company’s role. A manufacturer is responsible, among other things, for cybersecurity risk assessment, product security requirements, technical documentation, conformity assessment, and vulnerability handling.
A manufacturing company that purchases an off-the-shelf SCADA system for internal use is therefore in a different legal position than a company selling that system under its own name. Machines imported from outside the EU also require a separate assessment.
Are You Modifying a Product That Is Already on the Market?
For retrofits, updates, and modifications to existing machines, you need to determine whether the change qualifies as a substantial modification under the CRA. The European Commission’s current guidance dated July 27, 2026, includes a dedicated section on this topic because the nature and extent of a modification may affect the obligations applicable to an existing product.
Do not assume that every PLC replacement or SCADA update automatically creates a new product. First assess the nature and impact of the change.
For Industrial Machinery, CRA Obligations Extend Beyond the Acceptance Date
A manufacturer of a product covered by the CRA must define a support period and effectively handle vulnerabilities throughout that period. The European Commission indicates that the support period should be at least five years unless the product’s expected lifetime is shorter.
A machine manufacturer needs to be prepared for this before the product is sold. The organization should know which firmware versions, libraries, and components are included in the product, who monitors vulnerability information, and how security updates will be prepared and delivered to the user.
You can start preparing for the CRA by inventorying products, versions, components, vulnerability management processes, and support periods.
[Tu powinno być CTA – Prepare for the CRA with greater confidence. Start with technology consulting.
Button: Technology Consulting and Change Management) – CTA powinno być tak zaprojektowane, że po kliknięciu w buton prowadzi do tej podstrony – jeszcze jej nie mamy 😉 – jak wygląda obecnie takie CTA możesz zobaczyć tu: https://explitia.com/blog/cyber-resilience-act-mes-scada-machines/]
September 11, 2026 Changes Manufacturers’ Priorities
Starting September 11, 2026, manufacturers subject to Article 14 will be required to report actively exploited vulnerabilities and severe incidents affecting product security. An early warning must be submitted within 24 hours of becoming aware of the issue, while the full notification is generally due within 72 hours.
The transitional rule is also important. Products placed on the market before December 11, 2027 generally become subject to the remaining CRA requirements if they are substantially modified after that date. The reporting obligations are an exception and also apply to products made available on the market earlier.
Waiting until the end of 2027 to analyze your product portfolio could therefore leave a manufacturer without the procedures required as early as September 2026.
Where Should an Industrial Company Start Its CRA Assessment?
The first document does not need to be an extensive legal analysis. Create a product register that includes the product name and version, business owner, digital components, network interfaces, delivery model, sales market, your organization’s role, and the planned support period.
Involve people responsible for automation or product development, IT/OT, quality or compliance, and product market introduction. Webinar materials similarly indicate that CRA readiness requires collaboration across technical, security, quality, legal, procurement, and product management teams.
If you first need to organize communication between PLCs, SCADA, MES, and the plant network, knowledge of industrial IT infrastructure and IT/OT communications can help you build a clearer foundation.
For now, create a list of the MES systems, SCADA systems, and machines your company sells. For each one, record the connectivity model, delivery model, and your organization’s role. Products that meet the CRA criteria should then move to a detailed technical and legal qualification.
[Tu powinno być kolejne CTA – Don’t let new regulations catch you off guard. Let’s talk about your readines today.
Button: Book a Free Workshop) – CTA powinno być tak zaprojektowane, że po kliknięciu w buton prowadzi do podstrony warsztatu – jeszcze jej nie mamy 😉 – jak wygląda obecnie takie CTA możesz zobaczyć tu: https://explitia.com/blog/cyber-resilience-act-mes-scada-machines/]
AUTHOR WPISU
Katarzyna Swiatek
