Home
Hardware
Workstations · 2026 Catalog16 configurations with published prices Professional serversTower, rack and GPU, tested before delivery Compact systemsIndustrial MIL-STD-810H and made to measure
Configurator
Services
Renting with Care ProYour workstation on a monthly fee, support included Private AI for companiesAn AI server in your office · €770 set-up Custom projectsWe configure, build and test the hardware for your project
OEM Guides About us Warranty Contact
ESENDEFRITPT
Manufacturers · Regulation · CRA

Cyber Resilience Act (CRA): what it requires of the computer inside your machine

The EU Cyber Resilience Act is already under way: since 11 September 2026 manufacturers must report actively exploited security flaws, and from 11 December 2027 no product with digital elements can be sold in the EU without complying. If your machine has a computer inside, this applies to it too.

ACD&CO technical team23 October 20268 min read

What the CRA is and who it affects

Regulation (EU) 2024/2847, known as the CRA, sets cybersecurity requirements for products with digital elements: hardware and software that connect, directly or indirectly, to another device or a network. It applies to what is placed on the EU market, and the Commission’s 2026 guidance confirms that hardware with embedded software, such as a computer or a motherboard, is in scope.

The manufacturer is responsible: whoever places the product on the market under their name. If you sell a machine with a computer inside, you answer for the whole machine, and the computer is one of its most important digital parts.

This guide is for information and summarises the regulation as of October 2026. It does not replace advice from a specialist on your specific product.

The dates that matter

CRA and Machinery Regulation timeline
DateWhat starts
11 September 2026Reporting of actively exploited vulnerabilities and severe incidents: an early warning within 24 hours, a notification within 72 hours and a final report, through ENISA’s single reporting platform. Also for products already sold.
20 January 2027The new Machinery Regulation (EU) 2023/1230 applies, including protection of control systems against corruption.
11 December 2027Full CRA obligations: essential requirements, conformity assessment, technical documentation and CE marking under the regulation.

What the CRA asks for, in practice

  • Security by design and by default: no generic passwords and unnecessary services closed.
  • Vulnerability handling during the support period, which should generally be at least five years unless the product is expected to be used for less.
  • Free security updates, separate from functional updates where possible.
  • A software bill of materials (SBOM) in a machine-readable format, covering at least the top-level dependencies, in the technical documentation.
  • A point of contact where anyone can report a vulnerability, and the end-of-support date communicated to the user.

Non-compliance carries fines of up to 15 million euros or 2.5 % of worldwide turnover, and a product without the corresponding CE marking cannot be sold in the EU.

The computer inside: what to ask your supplier

Many machine builders run into the same problem: they cannot complete their documentation because their suppliers do not give them the information. For the computer, ask for this:

  • The list of components and firmware versions (BIOS or UEFI, controllers and remote management) of each configuration.
  • A commitment to firmware updates during your product’s support period.
  • A notice if a vulnerability appears in any of its parts, so you can meet your own 24-hour deadline.
  • A frozen platform: changing the computer forces you to review your technical documentation.
  • A long-support operating system (Windows IoT Enterprise LTSC or a Linux LTS release), Secure Boot and TPM enabled, and no account with a factory password.
  • A record per serial number of each unit’s exact configuration.

A simple plan until December 2027

  1. Take stock of your products and everything digital inside them.
  2. Ask every supplier for their parts list and their update commitments.
  3. Decide each product’s support period.
  4. Set up the vulnerability reporting process now: it has been mandatory since September 2026.
  5. Prepare the technical documentation and the conformity assessment, and have a specialist review them.

How we handle the computer in your product

In the OEM programme the computer ships on a frozen platform (no change without notice and revalidation), with its exact configuration and its 24-hour test result recorded by serial number, with your system image loaded and tested, with long-support operating systems and with remote management through a dedicated KVM-IPMI. On request, we provide the list of components and firmware versions of each unit for your technical documentation.

Manufacturers · seriesOEM programmeAny form factor, a frozen platform, your image and your brand.See →Guide · OEMOEM computer for your productWhat to ask the maker of the computer inside your machine.See →Guide · industrial computersFanless industrial mini PCWhen to choose one, which tests to check and which inputs to ask for.See →Guide · machine visionMachine vision computerGPU, cameras, PLC connection and form factor.See →Guide · OEMComponent obsolescenceHow to stop a discontinued part from halting your product.See →

Frequently asked questions

Does the CRA affect units I have already sold?

The obligation to report actively exploited vulnerabilities and severe incidents, in force since 11 September 2026, also applies to products already on the market. The other requirements apply to what is placed on the market from 11 December 2027.

What is an SBOM?

The software bill of materials: all the software, libraries and components in a product, with their versions. The CRA asks for it in a machine-readable format inside the technical documentation; it does not have to be published.

How long do I have to provide updates?

During the support period you declare, which should generally be at least five years unless the product is expected to be used for less.

What happens in case of non-compliance?

Fines can reach 15 million euros or 2.5 % of worldwide turnover, and a product without the corresponding CE marking cannot be sold in the EU.

Shall we prepare the computer in your machine?

Tell us what you build and how many units a year. We propose the platform and what we document for each unit in under 12 business hours.

See the OEM programme