Does the Cyber Resilience Act Apply to Robotics?
Learn if the EU CRA applies to Robotics, what the core compliance requirements are, and how to start preparing your engineering teams automatically.
Core Definition
Yes. The EU Cyber Resilience Act applies directly to Robotics as they fall under the definition of "products with digital elements." Industrial robots are not listed in Annex III or IV, so they follow the default conformity route unless their core functionality matches a listed category — but a compromised unit can cause physical harm, which the risk assessment must reflect. This means your hardware must meet mandatory cybersecurity requirements to be distributed in the EU market.
Key Compliance Steps for Robotics
- Determine Classification: Check if your Robotics falls under the default category, an important class (Annex III, class I or II) or the critical list (Annex IV), which dictate stricter conformity assessment paths.
- Perform Risk Assessment: Map out the attack surface for your hardware and physical components and document the mitigations for the "secure by design" requirement.
- Implement Vulnerability Reporting: Provide a 24-hour reporting mechanism to ENISA for actively exploited vulnerabilities.
- Generate an SBOM: Ensure all dependencies used in your Robotics are documented in a machine-readable Software Bill of Materials.
- Avoid the Common Pitfall: Safety certification (e.g. ISO 10218) gets assumed to cover cybersecurity, but functional safety and cyber-resilience are evaluated separately.
How This Plays Out in Practice
Industrial robots are not listed in Annex III or IV, so they follow the default conformity route unless their core functionality matches a listed category — but a compromised unit can cause physical harm, which the risk assessment must reflect.
What to Watch For
Safety certification (e.g. ISO 10218) gets assumed to cover cybersecurity, but functional safety and cyber-resilience are evaluated separately.
Common Questions
Does Annex I cover availability after an incident?
Where applicable, Annex I Part I, point (2)(h) requires protecting the availability of essential and basic functions, also after an incident, including through resilience and mitigation measures against denial-of-service attacks, and point (2)(k) requires reducing the impact of an incident using appropriate exploitation mitigation mechanisms and techniques.
How must security updates reach a deployed robot?
Annex I Part I, point (2)(c) requires that vulnerabilities can be addressed through security updates, and Annex I Part II, point (7) requires mechanisms to securely distribute updates so that vulnerabilities are fixed or mitigated in a timely manner.
Assess Your CRA Readiness
Evaluate your product's Cyber Resilience Act readiness using our interactive tool. Find exactly which of the 22 security requirements apply directly to Robotics.