Find out what the CRA requires of manufacturers

The Cyber Resilience Act (CRA) is the European regulation that sets the cybersecurity requirements for all products with digital elements sold in the Union, including connected machines for foodservice and hospitality. For those who build combi ovens, professional coffee machines, ice makers or connected dishwashers, the CRA obligations affect three moments: design, updates throughout the support period and incident reporting. Reporting has already been mandatory since 11 September 2026.

What the Cyber Resilience Act is and when it applies to manufacturers

The Cyber Resilience Act is Regulation (EU) 2024/2847, in force since 10 December 2024 and applicable in stages until 11 December 2027. Anyone who places a connected machine on the market must demonstrate that it is secure when they sell it and that it remains secure during the years in which the customer uses it.

The text of the regulation is available on EUR-Lex. For a foodservice equipment manufacturer there are four dates to keep in the diary.

The 2027 date may seem far away, but what counts is the moment each individual machine is sold: machines in stock or from a line already in production that are sold after 11 December 2027 must also be compliant. That is why, as Claudio Telmon of P4I pointed out in the Things5 webinar on CRA and NIS2, the contracts signed today with suppliers and development partners must already guarantee components that can be made compliant.

On 27 July 2026 the European Commission published the guidance on the application of the CRA, which clarifies, among other things, when apps and cloud services fall within its scope.

Which foodservice machines fall under the CRA

Every foodservice machine with a data connection, direct or indirect, to a device or a network falls under the CRA. The oven that receives recipes from the cloud, the coffee machine that sends its consumption data to an app and the blast chiller with a Wi-Fi module that notifies temperature alarms are all products with digital elements.

The scope also includes the software that runs the machine remotely. The app the customer uses to set programs and the cloud backend developed by you or under your responsibility fall under the CRA if, without them, the machine loses one of its functions, even when you sell them as a separate service. The regulation calls them remote data processing solutions. The company website, on the other hand, stays out.

The connection to consider is not only the internet one: a link to a local network, via Bluetooth or through a service port for the technician's PC also counts, so it is worth checking your range model by model. If you add connectivity to a model that did not have it, that model enters the scope of the CRA.

Foodservice machines do not appear in the lists of important and critical products, so they generally fall into the default category, which allows internal conformity assessment without a notified body.

What the CRA requires at the design stage

The CRA requires every connected machine to be designed on the basis of a cybersecurity risk assessment and to meet the essential requirements of Part I of Annex I. The requirements also cover the process by which you design, develop and maintain it. For a foodservice equipment manufacturer, seven requirements have the most direct impact.

• No known exploitable vulnerabilities at the time of sale: firmware and libraries must be checked before the machine is placed on the market.
• Secure configuration by default, with the possibility of restoring the machine to its original state. A service password identical on all machines contradicts this principle.
• Protection against unauthorized access, with appropriate authentication and identity management mechanisms for technicians, distributors and venue managers.
• Integrity and confidentiality of data, because recipes, cooking parameters, remote commands and temperature records for HACCP must not be open to tampering.
• Reduced attack surface, closing the ports, services and interfaces the machine does not use.
• Logging of security events, such as access and changes, with the possibility for the user to turn it off.
• Continuity of essential functions, for example an oven that keeps working safely if it loses its connection.

In a professional kitchen the machine often shares the Wi-Fi network with tills and payment terminals, and the venue's staff, the external technician and the distributor all work around it. The risk assessment starts from this scenario and from the context of use: a machine suited to a restaurant may not be suited to a hospital canteen.

For access management along the supply chain, Things5 Connect offers more than 40 granular permissions, 5 access levels to the configuration and a history of parameter changes.

Security updates and vulnerability handling

The CRA requires the manufacturer to handle vulnerabilities and distribute security updates throughout the machine's support period, in accordance with Part II of Annex I.

Support period and free updates

The support period is the time during which the manufacturer undertakes to fix the machine's vulnerabilities, and it normally cannot be shorter than 5 years. It must reflect the time the machine realistically stays in use. The end-of-support date must be communicated to the customer at the time of purchase, at least as month and year.

Security updates must be free of charge and, where technically feasible, separate from those that add functionality. Every update released must remain available for at least 10 years or for the rest of the support period, whichever is longer.

If every update requires a technician to visit the venue, distributing a fix to hundreds of machines becomes a cost that is hard to sustain for the whole support period. Things5 Connect distributes remote firmware updates, shows the outcome for each machine and lets you relaunch the update only where it did not succeed.

SBOM and coordinated vulnerability disclosure

The SBOM (Software Bill of Materials) is the list of the software components contained in the firmware, and the CRA requires it in a machine-readable format, at least for the top-level dependencies. A vulnerability in one of these components becomes a vulnerability of your machine.

The CRA also requires you to test the security of the machine regularly, to adopt a coordinated vulnerability disclosure policy with a public contact for reports and to disclose the vulnerabilities that have been fixed. For third-party components, such as connectivity modules or boards produced by an EMS (Electronics Manufacturing Services) partner, due diligence is needed: ask the supplier how it handles vulnerabilities and how it has done so in the past. Small or non-European suppliers and open source libraries are the hardest cases to check.

CRA reporting obligations: what to do within 24 hours

From 11 September 2026 the manufacturer must report every actively exploited vulnerability and every severe incident affecting the security of its machines. Reports go through ENISA's single reporting platform and reach the CSIRT of the country where the company has its main establishment. For Italy the reference is CSIRT Italia, at the National Cybersecurity Agency.

The incidents to report are not breakdowns, but events that compromise the security of the product, such as unauthorized access to the firmware development environment or the theft of the keys you use to sign updates.

There are three deadlines.

1. Early warning within 24 hours of becoming aware of the exploited vulnerability or the incident.
2. Notification within 72 hours, with the information available on the problem and on the corrective or mitigating measures.
3. Final report within 14 days of a corrective measure becoming available, for vulnerabilities, or within one month of the notification, for severe incidents.

The manufacturer must also inform the restaurants, hotels and chains involved and, where necessary, indicate the measures to reduce the risk.

Reporting does not require you to suspend sales, but to develop and distribute the fixes.

To meet the 24 hours you need to know within a few hours which machines are affected, where they are installed and who manages them. Things5 Connect monitors the measurements, states and events of every machine in real time. Its multi-organization structure connects manufacturer, distributors, service centers and end customers, so you know whom to tell about the problem.

Documentation, CE marking and penalties

From 11 December 2027 the CE marking of a new connected machine also certifies compliance with the CRA. To affix it, the manufacturer must complete the conformity assessment, draw up the technical documentation with the risk assessment and the SBOM, sign the EU declaration of conformity and provide the user with the security information.

Importers and distributors must also check the CE marking and the documentation before selling a machine, and anyone who sells it under their own brand is considered the manufacturer. In the foodservice supply chain, where many sales go through distributors and dealers, a machine without CRA documentation risks being left out of their price lists.

Penalties for breaches of the essential requirements and of the reporting obligations reach up to 15 million euros or 2.5% of total worldwide annual turnover, whichever is higher. The most concrete risk, however, is having to withdraw from the market a machine with a vulnerability you cannot fix, because it was not designed to receive updates.

How the CRA relates to NIS2, the RED directive and the Machinery Regulation

The CRA concerns the product, the NIS2 directive the security of organizations. A machinery manufacturer (ATECO codes 26 to 30) of at least medium size may fall directly under NIS2, transposed in Italy by Legislative Decree 138/2024, and the companies in the group also count when calculating size. Even those who stay out will come across it through regulated customers, such as healthcare facilities or food companies, who will ask for guarantees on the security of the machines and of remote support.

Machines with Wi-Fi, Bluetooth or cellular modules must also meet, since 1 August 2025, the cybersecurity requirements of the RED directive, with the EN 18031 standard as the technical reference.

From 20 January 2027 the Machinery Regulation (EU) 2023/1230 also applies, introducing requirements for protection against the corruption of control systems. We look at how these rules fit together in the webinar on CRA and NIS2.

How to prepare for the CRA: where to start

The most effective way to prepare for the CRA is to start from reporting, which is already in force, and build around it the processes you will need from 2027. There are seven concrete steps.

1. Map the installed base, that is, which models are connected, with which firmware, at which customers and distributors.
2. Assign roles for reporting, defining who assesses an anomaly, who decides whether it must be notified and who handles the early warning within 24 hours.
3. Build the SBOM of every firmware and ask the suppliers of modules and boards to do the same.
4. Review contracts with suppliers and development partners, asking for commitments on handling component vulnerabilities.
5. Define the support period of every model, taking into account the real life of machines in the kitchen and the cost of keeping them up to date.
6. Plan for remote updates on new machines and consider connecting existing ones through a gateway.
7. Review the design of new machines against the essential requirements, starting with access, default configuration and data integrity.

Things5 Connect provides the infrastructure for the CRA obligations on updates, access and visibility over the machines. Conformity assessment and the declaration remain the manufacturer's responsibility, and for their own case they can work with a legal advisor or a compliance expert.

Frequently asked questions