Is a Systems Integrator a CRA Manufacturer? PLC, HMI and Engineering Services

The Question Integrators Keep Asking

A small automation company selects standard PLC and HMI equipment, writes application software for one customer's plant, commissions it, and hands it over. It sells no product under its own name. Is it a manufacturer under Regulation (EU) 2024/2847? The Regulation has no role called 'systems integrator', so the answer comes from the definitions.

What the Definitions Say

• Manufacturer (Article 3(13)): someone who develops or manufactures products with digital elements, or has them designed, developed or manufactured, "and markets them under its name or trademark".
• Making available on the market (Article 3(22)): "the supply of a product with digital elements for distribution or use on the Union market in the course of a commercial activity". Recital 15 adds that the Regulation applies to economic operators only in relation to products made available on the market.
• Distributor (Article 3(17)): someone in the supply chain, other than the manufacturer or importer, that makes a product available "without affecting its properties".

Reselling Standard Hardware

If you supply unmodified equipment made by another manufacturer, you are likely acting as a distributor for that equipment. Article 20 then requires due care, a check that the product bears the CE marking and comes with the necessary documents, and informing the manufacturer of vulnerabilities you become aware of. Under Article 21 a distributor is treated as a manufacturer if it places a product on the market under its own name or trademark, or carries out a substantial modification.

A substantial modification (Article 3(30)) is a change after placing on the market that affects compliance with the Annex I Part I requirements, or that changes the intended purpose the product was assessed for. The intended purpose is set by the original manufacturer (Article 3(23)). Using equipment inside its documented intended use is the safer side of this line.

What the Commission Guidance Adds

The Commission published its guidance on 27 July 2026 (communication C(2026) 5252, with an annex). It is not binding, and the Regulation text remains decisive. Three passages matter to integrators:

• Computer code (section 2.3): the definition of software covers both source and machine code. Whether code is placed on the market depends on supply in the course of a commercial activity. Unfinished code shared during development, and sample or demo code, is not placed on the market. Code supplied to customers as a product with digital elements is.
• Complex systems (section 2.6): a system placed on the market as a single product with digital elements is in scope. Long design cycles and legacy constraints do not exclude it. They are handled through the cybersecurity risk assessment under Article 13(2).
• Integration (paragraphs 117 to 120): someone who assembles components into "a new product with digital elements that they themselves place on the market" is the manufacturer of that product. This is distinct from substantial modification of a product another manufacturer already placed on the market.

What Stays Open

The guidance does not discuss one-off, customer-specific project software or systems integrators as such. The Regulation does recognise 'tailor-made' products fitted to a particular business user (recital 64 and Annex I Part I, points (2)(b) and (8)), so bespoke software is not automatically out of scope. Whether your delivered system counts as a product placed on the market by you, when it carries no brand of yours and is handed to a customer or principal contractor, is something to confirm with a lawyer or your national market surveillance authority.

Reusing Your Own Function Blocks and Templates

Internal reuse does not by itself make you a manufacturer of those libraries. Code you never supply, license or sell as its own item is not placed on the market. The libraries do reach the customer compiled into the delivered application, so the question returns to that deliverable: what you hand over, and under whose name.

Practical Steps

• Record what you supply, and under whose name or trademark.
• Keep reusable software assets separate from project-specific work, and note whether you ever supply them on their own.
• Ask equipment vendors for their CRA information. For products intended for integration into other products, Annex II point 8(f) requires the manufacturer to provide the information an integrator needs to comply with Annex I and the Annex VII documentation requirements.
• If you do place your own system on the market, manufacturers must exercise due diligence when integrating third-party components (Article 13(5)).
• Check other legislation too, such as the Machinery Regulation (EU) 2023/1230, which can apply whatever the CRA says.

This article is general information, not legal advice. See also what counts as a product with digital elements, or take the free assessment to see which role fits you today.