Home page / ... / /
About Danfoss
/ Our businesses
/ Power Solutions
/ EU Cybersecurity Compliance for Mobile Machinery | CRA, MR & RED

EU Cybersecurity Compliance for Mobile Machinery | CRA, MR & RED

Cybersecurity at the core

At Danfoss Power Solutions, we lead the way to a sustainable future by transforming mobile and industrial machinery to meet the latest cybersecurity standards.

Our commitment to innovation and efficiency ensures compliance with evolving regulations. Discover how our expertise in cybersecurity and sustainability can enhance your operations.

The EU's Cyber Resilience Act and Machinery Regulation are setting new benchmarks for cybersecurity in off-highway vehicles.

These regulations require manufacturers to implement comprehensive security measures across the product lifecycle, from design and development to operation and decommissioning.

Our team is here to guide you through these changes:

Danfoss will ensure your products not only comply but excel in reliability and safety.
Danfoss will teach you why cybersecurity is crucial for safeguarding industrial machinery against digital threats.

What is the RED Delegated Act (EU) 2022/30

The RED Delegated Act (EU) 2022/30 introduces mandatory cybersecurity requirements for the design and certification of radio equipment in Europe. RED compliance is a prerequisite for CE marking of all in‑scope products. It applies to radio equipment devices that emit or receive radio waves for communication e.g. Wi-Fi, Bluetooth or LTE, such as telemetry devices.

Key aspects:

Equipment must be safe for user
Equipment must avoid harmful interference
Equipment shall ensure an adequate level of electromagnetic compatibility
RED DA compliance is now a prerequisite for CE marking starting August 1st, 2025. Without it, a product cannot be legally sold in the EU.

Key requirements:

Protection of the network or its functioning from harm
Protection of personal data and privacy of the user
Protection from fraud

What is the Machinery Regulation (EU) 2023/1230

The Machinery Regulation (EU) 2023/1230 fundamentally transforms how machinery products are developed, certified, and operated in Europe. It introduces stricter requirements for safety and cybersecurity, mandates digital documentation throughout the product lifecycle, and establishes new, more rigorous compliance and conformity assessment procedures.

Key aspects:

Make safety and risk management core requirements for all machinery and related products, from initial design through post-market monitoring.
Requires modern machinery to address new risks related to automation, digitalization, artificial intelligence, and connectivity ensuring machinery is safe even as technologies evolve.
The new MR compliance is becoming mandatory for CE marking from 2027 forward. Without Machinery Regulation compliance, products cannot be legally placed on the EU market.
For the first time, digital instructions for use and documentation are allowed, streamlining information delivery and conformity processes for manufacturers and users alike.

Key requirements:

Conduct a product risk assessment
Ensure protection of the health and safety of persons
Ensure protection against corruption
Evidence collection of legitimate or illegitimate intervention (connection or software update)
Provide Software integrity

What is the Cyber Resilience Act 2024/2847

The Cyber Resilience Act 2024/2847 is an EU rule which sets the boundary conditions for the development of secure products with digital elements by ensuring that hardware and software products are placed on the market with fewer vulnerabilities and that security is seriously guaranteed throughout a product’s lifecycle.

Key Aspects:

Make cybersecurity a core requirement for all products with digital elements, from design to post-market.
Ensures that digital products are secure by default, reducing risks for consumers and businesses.
CRA compliance is now a prerequisite for CE marking starting in 2027. Without CRA compliance, a product cannot be sold in the EU.

Key requirements:

Integrate Security-by-Design principles throughout the product lifecycle
Develop secure configuration guidelines for users for update in field
Fulfill manufacturer obligations like creating Software Bill of Materials (SBOMs)
Establish security monitoring
Report vulnerability to legal entity and user over the product life cycle

Our Solution

Navigating the EU's Cyber Resilience Act, Machinery Regulation, and Radio Equipment Directive can be complex, but at Danfoss Power Solutions, we make compliance seamless for you. We start with a thorough Threat Analysis and Risk Assessment (TARA) to understand product and solution vulnerabilities, ensuring tailored solutions that enhance your operations.

Our comprehensive security measures not only protect against cyber threats but also optimize performance, offering you peace of mind and a competitive edge. With our expert guidance, you can expect:

Secure Boot for reliable startup
Signed firmware and applications for integrity assurance
Seamless secure firmware upgrades
Customized secure configuration
- Verified signed configuration
- Rigorous input value validation
- Robust authentication using passwords, symmetric keys, and asymmetric keys
- Advanced Public Key Infrastructure (PKI)
Secure communication channels
Detailed documentation, including Security Manuals and Software Bill of Materials (SBOM)

Just as functional safety standards protect against physical accidents, cybersecurity shields against digital threats, ensuring trustworthy and resilient operations. At Danfoss Power Solutions, we understand the significance of cybersecurity and are committed to helping you secure your machinery against emerging threats.

Sylvie Mbayin

Product Cybersecurity Lead

Your Partner

Global partnerships and expert solutions

Our partnership approach is built on collaboration and trust. Leveraging our unparalleled application know-how, we work closely with customers around the world to solve their greatest machine challenges. Through tailored solutions and expert guidance, we help you achieve your vision and secure your position as a leader in the industry.

Achieving compliance with cybersecurity regulations is more than a legal obligation; it's a strategic advantage. Danfoss's sustainable solutions not only enhance machine reliability but also position your business for long-term success in a competitive market. By prioritizing sustainability, you can drive innovation and secure your place as a preferred and trusted partner for your customers.

Key Benefits of Working with Danfoss

Achieve Compliance with Ease

Our backward-compatible cybersecure products simplify compliance, eliminating complex redesigns and allowing you to focus on your core business activities without worry.
Secure Your Operations

We provide robust security solutions that protect your operations from threats, ensuring safety and reliability in your processes.
Drive Innovation Forward

Collaborate with us to leverage cutting-edge technologies and innovative strategies that propel your business into the future.

FAQ

Does my off-highway equipment need to comply with CRA, Machinery Regulation, AND RED?

It depends on your product's features. The CRA applies to almost all products with digital elements. The Machinery Regulation (MR) applies if your product has a safety function. RED applies if your product uses radio technology such as Bluetooth, Wi-Fi, or cellular connectivity. One product may need to comply with all three regulations.

What exactly qualifies as a "product with digital elements" under CRA?

Any hardware or software product that can exchange data with another device or network. Examples include controllers, displays, telematics units, mobile applications, and embedded software.

Does CRA apply to existing products already on the market?

No, products already on the market are not retroactively covered. CRA applies to products first placed on the market from December 2027 onwards, including substantially modified products or new versions.

If my machine only uses Bluetooth for diagnostics, do I need RED compliance?

Yes. Even diagnostic Bluetooth makes the machine radio equipment and therefore subject to RED. The RED cybersecurity requirements apply until CRA takes over in December 2027.

Are replacement parts and spare parts subject to these regulations?

Under the CRA, identical spare parts manufactured to the original specifications are exempt. A non-identical replacement part may itself be subject to CRA when placed on the EU market separately; the repaired product is affected only where the replacement constitutes a substantial modification.

Under RED and MR, the assessment focuses on whether the spare part is placed on the market as a separate product and whether its installation substantially modifies the original radio equipment or machinery.

Do agricultural tractors, construction equipment, and forestry machines all fall under the same requirements?

Yes, generally. The regulations apply based on the machine’s functions (e.g., digital elements, safety functions, radio equipment), not its sector. Applicable standards may differ by product type and use case. Other sectors such as military, automotive, or marine may instead be governed by sector-specific legislation.

What about imported equipment from non-EU manufacturers?

All products placed on the EU market must meet the applicable requirements, regardless of where the manufacturer is located. For non-EU manufacturers, the EU-based importer has specific compliance responsibilities before placing the product on the market.

What are the exact compliance deadlines for CRA, MR, and RED?

RED: August 1, 2025 (for the relevant cybersecurity requirements for radio equipment)
CRA: September 11, 2026 (for vulnerability and incident reporting obligations); December 11, 2027 (for the main CRA requirements)
Machinery Regulation: January 20, 2027

Can I still sell non-compliant products after the deadline if I have existing inventory?

Not necessarily. The decisive date is not when a product is ultimately sold to the customer, but when that individual unit was first made available on the EU market ("placed on the market").

How long does it typically take to achieve full compliance?

There's no single answer, but a comprehensive implementation can easily take 18-24 months. It involves everything from product design and development to documentation and testing.

Is there a grace period or transition phase?

There is no grace period after the applicable date. The transition period is the lead time before the regulation applies; once the deadline is reached, products first placed on the EU market must comply.

What happens if we miss the deadline?

After the deadline, non-compliant products cannot be sold in the EU and may be subject to market bans, withdrawal or recall, and administrative fines.

Contact Us

Cybersecurity for secure-by-design machinery

Our white paper, "Cybersecurity for secure-by-design machinery," provides an in-depth analysis on how to navigate the EU machinery regulation and Cyber Resilience Act.

Download your free copy today!

Download white paper

Ready to take the next step?

Partner with Danfoss for expert consultation, security assessments, and tailored solutions that align with your specific needs. Our team is dedicated to helping you achieve your vision and secure your place as a leader in the industry. Contact us today to learn more about how we can support your journey towards greater security and compliance.