CRA, the Machinery Regulation and NIS-2 each require their own risk assessment. We explain what manufacturers, integrators and operators must do.
The tasks can be clearly assigned: the manufacturer assesses its product, the integrator its integration and the operator the specific use. The assessments build on each other. None replaces the other.
The manufacturer — address product risks
The manufacturer of the labeling module must assess how its remote service access could be abused and which protective measures are required. It decides on authentication, permissions and secure updates.
These decisions cannot be delegated to the later operator. The CRA requires a dedicated, documented cybersecurity risk assessment. It must feed into development and be updated during the support period when necessary.
Why the manufacturer? Because it designs the product. Missing protection functions can often only be compensated later by the operator through additional measures in their environment.
The manufacturer must take the intended and reasonably foreseeable use into account. Customer requirements help to specify this. They are not a prerequisite for beginning the assessment.
Operating conditions — clearly state what is required
A product does not have to be designed for every conceivable environment. However, the manufacturer must describe under which conditions it can be used safely.
For the labeling module this could mean, for example:
Such prerequisites belong in the user information. The blanket sentence “The operator is responsible for IT security” is not sufficient. Nor can required protective measures be replaced at the product level by notes in the manual.
A secure default configuration remains the manufacturer’s responsibility, insofar as the corresponding CRA requirement applies. The operator must still set up and securely integrate the product. However, they should not have to disable unnecessary services first in order to establish a secure starting state.
The manufacturer must make clear what the product provides — and what the operating environment must additionally provide.
Where does your risk assessment stand?
Our readiness check shows you which basics are in place and which next steps are required for CRA compliance.
The integrator — assess risks during assembly
Individually assessed components do not automatically result in a securely integrated system.
The integrator must check: do the operating conditions of the modules match? Which connections are required? Do shared networks or remote service accesses create new risks?
Why the integrator? Because risks can arise during assembly that are not covered by an assessment of any single component.
In addition, the integrator must clarify its legal role. A company that assembles several modules into a complete packaging line can become the manufacturer of that line under machinery law. Whether additional manufacturer obligations under the CRA arise depends on the resulting product and how it is provided.
“Integrator” is therefore not a fixed legal role. What matters is what the company actually builds, modifies and provides.
The operator — assess risks to their own operations
The operator considers the labeling module as part of their plant. They must know what consequences a failure or tampering would have:
- Will only the module stop or the entire packaging line?
- Can incorrectly labeled products continue to be processed unnoticed?
- Does the remote service access open a path to other systems?
From this follow measures for the actual operating environment: segmentation, access rules, controlled maintenance and restart procedures.
For entities in the NIS-2 scope, appropriate technical, operational and organizational risk management measures are mandatory according to the respective implementation rules. Even outside that scope, a secure operational organization remains sensible.
Why the operator? Because only they know the actual processes, dependencies and consequences of outages.
They should therefore demand concrete answers from the manufacturer: which protective functions does the product provide? Which operating conditions apply? Which measures must they supplement on site?
CRA MVO and NIS-2 — different tasks, shared interfaces
The three frameworks look at risks from different perspectives:
| Framework | Who bears the central responsibility? | What must be considered? |
|---|---|---|
| CRA | Manufacturer of the covered product | Cybersecurity risks of the product with digital elements |
| MVO | Manufacturer of the machine or incomplete machine | Safety and health risks, including safety-relevant manipulation |
| NIS-2 | Covered entity | Risks to its network and information systems and their operation |
The interfaces are important: if the labeling module is manipulated via the remote service access, production can be interrupted. If the manipulation triggers dangerous machine movements, it also affects machine safety.
The assessments must therefore be coordinated. A product assessment alone does not answer how secure the entire plant is. Conversely, an operational risk assessment does not replace the manufacturer’s obligations.
Standards and CE marking — helpful but not a substitute for your own assessment
IEC 62443-3-2 helps divide an automation system into zones and conduits and to assess its risks. A complete product-related CRA assessment does not automatically result from this.
A CE mark also does not answer all questions. An incomplete machine module can, for example, carry a CE marking due to the CRA even though it receives an installation declaration under machinery law. Which rules the CE marking covers is shown by the accompanying EU declaration of conformity.
For the integrator and the operator this means: check declarations and user information. Only then does it become clear which properties are guaranteed and which operating conditions are assumed.
No one can wait for the other’s assessment
Product development, integration and plant planning often run in parallel. Information must therefore flow in both directions. Responsibility remains clear:
The manufacturer assesses the product. The integrator assesses the interaction. The operator assesses the use in their own operations.
Everyone needs information from the others. No one can fully hand over their own task to them.
For manufacturers this means: assess your product — even if no customer asks for it.
How far along is your risk assessment as a manufacturer really?
In a few minutes you can see where your product risk assessment stands today and what is still missing for compliance.
