Machinery Regulation and CRA: coupled through standards, not cross-references

Two objectives

The Machinery Regulation asks whether a machine stays safe. Its requirements 1.1.9 and 1.2.1 of Annex III treat corruption — accidental or malicious, physical or through a network — as a cause of hazards: a manipulated parameter, a defeated safety function, an unsafe state after an attack.

The Cyber Resilience Act asks whether a product with digital elements is secure: secure by design and default, protected against unauthorized access, with vulnerability handling and security updates over the support period.

Both meet at the safety-security interface, but they ask different questions. A secure product can still be unsafe, and a safe machine does not meet CRA obligations such as vulnerability reporting.

Why a cross-reference does not work

A direct reference would only be clean if both acts covered the same products and the same requirements. They do not:

• Scope: the MR covers machinery and related products whether or not they contain digital elements; the CRA covers products with digital elements, including software and components that are not machinery.
• Exemptions: each act excludes different product groups and refers to different sector law.
• Content: 1.2.1 covers far more than security (faults, logic errors, foreseeable human error), so CRA conformity could not stand in for it.

The CRA proposal therefore lost its machinery article, which would have deemed a CRA declaration of conformity to cover 1.1.9 and 1.2.1. The final CRA keeps the link in Recital 53: the Commission and the European standardisation organisations take the CRA into account when preparing harmonised standards for the Machinery Regulation.

Where the coupling happens

Consistency comes from standards. Standards committees define the method that links a hazard analysis with a threat analysis, assign protection needs to safety functions and point to the security controls of IEC 62443. That is safety-security convergence done methodically. The machinery draft standard EN 50742 on protection against corruption is one example.

For documentation

The technical documentation of a product under both acts keeps two lines of evidence: the risk assessment and safety evidence for the MR, the cybersecurity risk assessment and vulnerability handling for the CRA, with explicit links where one supports the other. Only a harmonised standard whose reference is cited in the Official Journal gives presumption of conformity, and only for the requirements it covers.