Cyber Resilience Act for machine builders
Which of your machines
are affected?
A vulnerability is reported. Transaction-Network connects your installed base with machines, parts lists, components and software versions. So you know which machines are affected, which customers you need to inform and what belongs in your CRA documentation.
The reporting obligation applies.Also to machines in the field.Since September 11, 2026.
The real problem
The CRA demands evidence. The gap is in your installed base.
The real hurdle is the question of which of your delivered machines are affected by a vulnerability. Most companies are missing this link.
As long as vulnerability, component, software version, machine and customer are not connected, every CRA question remains a search.
What makes it hard:
- Many machines in the field
- Many built-in components
- Different software versions
- Different customers
- Different years of manufacture
- Information scattered or missing
The deadlines
Two dates that count.
September 11, 2026
Reporting obligation
A manufacturer reports every actively exploited vulnerability. This also applies to machines delivered before December 11, 2027.
Art. 14 and Art. 69(3) CRA
December 11, 2027
All obligations
For machines placed on the market from then on: requirements of Annex I, technical documentation, conformity assessment and CE marking.
Art. 71(2) CRA
What the CRA requires and what a breach costs.
24 hours
Early warning
If a vulnerability is actively exploited, you send an early warning within 24 hours. The notification follows within 72 hours and the final report within 14 days after the fix.
Art. 14(1) to (4) CRA
At least 5 years
Security updates
You set a support period for every machine, generally at least five years. During that time you provide security updates free of charge.
Art. 13(8) and Annex I Part II CRA
Up to €15 million
Fine
Or 2.5% of worldwide annual turnover, whichever is higher. This applies to breaches of the requirements in Annex I and the obligations in Articles 13 and 14.
Art. 64(2) CRA
Situations you know
Three moments when it gets real.
A CVE is published.
Which of your machines are affected?
Transaction-Network connects vulnerability information with your installed base and the built-in components.
A customer asks for the SBOM.
Which components and software versions are built in?
The information sits with each machine, retrievable by serial number.
An audit is coming up.
Where does the evidence come from?
Machine, components, software versions, changes and measures are documented traceably.
The solution
Transaction-Network connects cybersecurity with the real machine.
With us, every machine is connected to everything you need in a CRA case:
- Machine and serial number
- Parts list
- Components
- Software versions
- Customer
- Location
- Changes
- Vulnerabilities and measures
- Vulnerability
- Component
- Machine
- Installed base
- Customer
- Measure
From the vulnerability to the affected machine.
Select a machine
You see the built-in components.
View software versions
With every change per serial number.
Spot the component
The vulnerability hits a specific part.
Find affected machines
All serial numbers with this component.
Derive customers
With location: who needs to be informed is clear.
Document measures
Traceable per machine, for every audit.
- Problem
- A new vulnerability affects a built-in controller.
- Solution
- Transaction-Network finds the affected machines from the stored components and software versions.
- Result
- You know which customers are affected and which measures are needed.
Software for machine builders, not CRA consulting. The CRA module is also available on its own. Pricing for manufacturers
The difference
Why machine builders need their own CRA tool.
| Generic CRA tool | Transaction-Network |
|---|---|
| Generic compliance logic | Built for machine builders |
| Stops at the product version | Reaches the serial number and the customer |
| The data structure has to be built first | Brings the bill of materials for every machine |
| A compliance island | Extends to spare parts, service and maintenance |
Targeted updates across your installed base.
Every software version of every machine sits in one place. You roll out updates to exactly the affected machines, with a record of who received which version and when.
Free · about 3 minutes · instant result
How CRA-ready is your installed base?
Six questions, no login, no form up front. You decide after the result whether you want to talk to us.
Your result
This is exactly where Transaction-Network comes in: the link between a vulnerability and the specific machine.
Leave your contact details and we will discuss your result in a short call.
Thank you. We will get back to you with a suggested time.
That didn't work. Write to us at sales@transaction-network.com.
Or book a time right away: Book a demo
Questions
What machine builders ask about the CRA.
Which machines does the CRA apply to?
To products with digital elements that can be connected directly or indirectly to a network. That covers the vast majority of modern machines, from CNC machines and packaging lines to special machines with control software. For machines already delivered, the reporting obligation applies since September 11, 2026; the other obligations apply to them if they are substantially modified after December 11, 2027.
What do machine builders have to document?
Which components and software versions are built into your machines, how you handle vulnerabilities, which measures you take and how you inform affected customers. The core is linking all of this to the specific machine.
What is an SBOM?
An SBOM (software bill of materials) is a structured list of all software components in a product, including open-source libraries, firmware and third-party software. It lets you see which machines are affected by a new vulnerability.
How do I deal with my installed base?
The installed base is the real crux: many machines, different years, customers and software versions. Transaction-Network maps every machine with serial number, components and software version. You work in a structured way, starting with the machines with the highest risk.
How do I identify affected machines?
Transaction-Network connects vulnerability information with the stored components and software versions of your machines. When a vulnerability becomes known, you see which serial numbers are affected and which customers to inform, in minutes instead of days.
How are software versions documented?
Per machine and serial number, updated with every change. So you can prove at any time which version runs on which machine.
How are customers informed?
Every machine is assigned to a location and customer. When a vulnerability appears, the list of affected customers is ready immediately; communication and measures are documented traceably.
How quickly can Transaction-Network be introduced?
Usually in about four weeks, without a big IT project. You start with the most important machine types and build up your installed base step by step.
What data does Transaction-Network need?
To start: your machines with serial numbers, the components or parts lists, the software versions and customer and location. We take over data from your systems.
How does the connection to existing systems work?
Transaction-Network connects to ERP, PLM and service systems so that machine, component and customer data is not maintained twice. We clarify the details in the demo based on your system landscape.
How do I meet the CRA reporting obligation for my installed base and manage the SBOM for each machine?
Since September 11, 2026 you must report an actively exploited vulnerability within 24 hours. To do so you need to know which delivered machines contain the affected component: in Transaction-Network, the bill of materials, software versions and SBOM sit on each machine, retrievable by serial number and linked to the customer. That takes you from the vulnerability straight to the affected machines and customers.
Demo
See in 30 minutes how the CRA
comes together with your installed base.
No slides: you see the system live, and together we look at which gaps can be closed for your machines.