Support period
You set it and you publish it. If you publish 15 years, security updates have to be possible across that period.
Industrial equipment
Ready to report an exploited bug in a machine you shipped years ago
Article 14 covers products already in the field. On a delivery date agreed in writing, we set up who decides and what gets sent, on your equipment.
Checked against the regulation on 16 Oct 2026 · What changed
One fixed price, in writing, the same day you ask · a delivery date agreed in writing · about 4 hours of your engineers' time · the price only changes if the scope does.
NDA before anything sensitive · the drill runs on sample data · no production access · every document is yours.
Long support periods · Beside the Machinery Regulation · Reporting applies now
The CRA for industrial equipment with long service lives
A long life changes the duty
The machine stays in the field longer than a consumer product, so the support period and the update plan carry more weight.
Industrial equipment with digital elements is in scope when you place it on the EU market. The duties that weigh most are the support period you set, and an update approach that follows your own risk assessment rather than a consumer-style automatic update.
Products already on the market before 11 December 2027 must meet the full requirements only if they are substantially modified after that date. Article 14 reporting applies to them anyway. A machine you are not modifying still needs a way to report an actively exploited vulnerability.
The duties that weigh most
Support, the risk assessment you already do, and a reporting path that does not assume a short product life.
Updates and risk
The update approach follows your risk assessment, including on a machine with a long service life.
Two regulations
The Machinery Regulation still applies. Both regulations apply. Some CRA evidence can support the Machinery file. Your adviser decides how they map.
Reporting regardless
A legacy machine that is not substantially modified can still be in scope for Article 14 reporting.
Reporting: applies since 11 Sep 2026 · Everything else: 11 Dec 2027 · Full timeline
What usually comes first
Name who reports, then decide the support period you can keep.
Usually first
- A reporting runbook for the products still on the market.
- Named roles, including a backup, for a long-lived product.
- A published support period you can keep.
Can follow
- Vulnerability handling across that support period.
- SBOMs for the software in the machine.
- The technical file before December 2027, beside the machinery file.
Related
Questions
How does the price work?
One fixed price for your product, in writing, the same day you ask. It only changes if the scope does.
Do you see our real vulnerability data?
No. The drill runs on sample data. We sign an NDA or DPA before you share anything sensitive.
We already work with a test lab or consultant.
That's fine. We set up the reporting process and they keep the legal and assessment work.
We're outside the EU but sell there.
Article 14 applies to products on the EU market, wherever the maker is based.
Do devices we sold years ago count?
Yes for reporting. Article 14 covers products already on the market.
Do we support machines for 15 years?
The support period is one you set and publish. If you publish 15 years, security updates have to be possible across that period. We record the number you choose.
Do legacy machines need to meet the full CRA?
Only if they are substantially modified after 11 December 2027. Reporting under Article 14 applies to products on the EU market regardless.
How does IEC 62443 relate to the CRA?
IEC 62443 is the series of standards for industrial automation and control system security. Many machine makers already use parts of it, and that work can feed your CRA evidence. It does not cover Article 14 reporting, which applies now.
Samisoftz builds the process and software your team uses to organise CRA evidence and reporting. You stay responsible for meeting the regulation. We don't give legal advice, act as a notified body, or submit reports for you.
On a delivery date agreed in writing, your team will know who decides, what to send at 24 and 72 hours, and will have practised it once on your own product. The decision to report stays with you. We set up how.
Could your team send a 24-hour early warning tomorrow? Find out in 30 minutes.
You'll talk to Usama, who'd build it.
30 minutes · no slides · a written answer if it's not a fit
One fixed price, in writing, the same day you ask · a delivery date agreed in writing · about 4 hours of your engineers' time · the price only changes if the scope does.
NDA before anything sensitive · the drill runs on sample data · no production access · every document is yours.