Xabier Antolin: Yes. Anyone who views the CRA as solely a matter for the IT department underestimates its scope. The regulation applies to products with digital elements and thus to their development, manufacturing, and maintenance. In mechanical engineering, therefore, it’s not just IT managers who are affected, but also design, product management, purchasing, quality management, documentation, and service. This is an important shift in perspective. Cybersecurity is becoming a product characteristic. Companies must not only protect their own networks but also assess the risks a product may pose, how it is intended to be used, and the limits for safe operation.
Xabier Antolin: First and foremost, clear reporting channels are needed. Customers, security researchers, or partners need to know who to contact if they discover a potential vulnerability. Internally, there must be established procedures for how a report is reviewed, assessed, and forwarded to the appropriate departments. A Product Security Incident Response Team (PSIRT) can play a central role in this process. Such a team consolidates information, coordinates the technical assessment, and manages communication. This is primarily an organizational task. Without defined responsibilities, even good technical tools are of limited help.
Marc Wiederoder: In some cases, only the documentation will need to be updated. However, that alone is often not enough. Depending on the product, changes to hardware, firmware, interfaces, or update mechanisms may be necessary. Cybersecurity cannot be retrofitted to a finished product—or can only be done so with great effort. If fundamental requirements are not considered until shortly before market launch, making changes can become very costly. That is why security-by-design is so important: threats, potential attack vectors, and protective measures must be taken into account as early as the concept and development phases.
Marc Wiederoder: From a cybersecurity perspective, market launch is not the end of development, but rather the beginning of a new phase. New attack methods, vulnerabilities in software components used, or changed usage scenarios can call an earlier risk assessment into question. As long as a product is in its active lifecycle, relevant developments must be monitored and evaluated. Cybersecurity does not end with product release. Companies therefore need procedures that allow them to regularly review their products and respond to new vulnerabilities or requirements.
Xabier Antolin: Equally important is the exchange of information across company boundaries. Participation in security initiatives, CERT structures, and vulnerability databases helps ensure that new findings are addressed early on. No manufacturer can solve industrial cybersecurity in isolation. It is crucial that information is reliably exchanged and translated into concrete measures. The CRA makes this collaboration more binding—and compels companies not only to promise security at the time of delivery but to organize it over the course of many years.
Xabier Antolin: NIS2 structures can serve as a solid organizational foundation. Companies have often already defined responsibilities, established reporting channels, and established information security as a management priority. However, the CRA additionally requires a thorough examination of the product itself. General information security is no substitute for security-by-design, the assessment of product components, or vulnerability management throughout the product lifecycle. Both sets of regulations overlap, but they have different priorities.
Xabier Antolin: It’s becoming more dynamic. With new software or firmware versions, operators must be able to verify what changes have been made, what prerequisites apply, and whether the intended application context has changed. An update can close a vulnerability, but at the same time introduce new requirements for configuration or compatibility. That’s why documentation must not be viewed as a one-time accompanying document. It is an integral part of secure operation and must be consistently taken into account with new versions.
Which products are affected? The CRA generally covers hardware and software whose intended or reasonably foreseeable use involves a direct or indirect connection to a device or network. In an industrial setting, this may include, among other things, control systems, networked sensors, communication components, firmware, industrial software, and software-based safety components. Exceptions apply to certain areas—such as medical devices, which are already regulated on a sector-specific basis.
Government oversight is carried out by the national market surveillance authorities. In Germany, the federal government has designated the Federal Office for Information Security (BSI) as the market surveillance and notifying authority. The BSI can inspect products and technical documentation and, in the event of violations, initiate corrective measures, including sales restrictions or a recall . The national legal framework is established through the German Implementation Act for the CRA.
Who is responsible for implementing the requirements? The primary responsibility lies with the manufacturer. A company that commissions the development of a product and places it on the market under its own name or brand is also considered a manufacturer. Manufacturers must, among other things, assess cyber risks, incorporate security-by-design, prepare technical documentation, address vulnerabilities during the support period, and demonstrate the product’s conformity.
资料来源：企业官网公司介绍页面（复核日期：2026-10-29）。