EU CRA ComplianceA Malkan Solutions company
Product classifier See the CRA Workbench →Workbench →

Product classifierDefaultRegulation (EU) 2024/2847

Is a PLC covered by the EU Cyber Resilience Act?

The short answer, the Official Journal text behind it, and the judgment calls an assessor will test.

01
Verdict

programmable logic controller (PLC)

In scope · Default class

Scope
In scope if it has a direct or indirect data connection to a device or network (Article 2(1)) — almost every modern one does.
Class
Default — Not in Annex III or IV.
Route
Self-assessment is available: internal control (Module A, Annex VIII) under Article 32(1). No notified body is needed, but the full Annex I evidence and the Annex VII technical file still are.
Dates
Article 14 reporting has applied since 11 September 2026; the main obligations apply from 11 December 2027 (Article 71).

A networked PLC is in scope of the CRA — but no Annex III or IV category names a PLC, so it sits in the default class.

02
Why

Why it lands in this class

A PLC’s core function is executing control logic against I/O. None of the Annex III or IV categories describes that function, so the product is not ‘important’ or ‘critical’ by default.

PLCs often contain things that are listed — a real-time operating system, an Ethernet or fieldbus interface, sometimes a VPN client. Article 7(1) is explicit that integrating such a component does not by itself pull the whole PLC into the Class I procedures.

“a product with digital elements that has the ability to perform the functions of a product category set out in Annexes III and IV to Regulation (EU) 2024/2847 but whose core functionality itself is different from that of such product category is not to be considered to meet the technical description of that product category.”

— Implementing Regulation (EU) 2025/2392, recital 5

“The integration of a product with digital elements which has the core functionality of a product category set out in Annex III shall not in itself render the product in which it is integrated subject to the conformity assessment procedures referred to in Article 32(2) and (3).”

— Regulation (EU) 2024/2847, Article 7(1)

Source: Regulation (EU) 2024/2847 — Articles 2(1), 7(1), 32; Annexes III–IV. Implementing Regulation (EU) 2025/2392.

03
Edge cases

When the answer changes

  • You sell the communication module (a PROFINET, EtherNet/IP or fieldbus card) as a separate product: that module can match ‘physical network interfaces’ — see fieldbus interface modules.
  • The product is marketed primarily as a secure remote-access or VPN endpoint rather than a controller: the core-function reading may shift to Class I.
  • It is a safety PLC: CRA classification is unchanged, but expect the Machinery Regulation interplay to feature in your risk assessment.
04
Auditor view

What an assessor will ask you to show

Class decides the route. It doesn’t reduce the work: every product needs the full Annex I evidence, an Article 13 risk assessment and an Annex VII technical file.

  • Your written core-functionality determination, and why no Annex III category matches.
  • An inventory of the integrated components that are themselves listed (RTOS, network stack, VPN) and how their security is evidenced as part of the whole product.
  • Your support period for a controller that will run for 15–20 years, and how updates reach a device that may never be connected to the internet.

Already developing to IEC 62443-4-1? See which requirements map to which CRA obligations in the IEC 62443 ↔ CRA crosswalk, and check your organisation’s footing with the CRA readiness score.

Classification is step one of six.

The CRA Workbench records your core-functionality reasoning the way an assessor will read it, then carries it through risk, Annex I, conformity route, vulnerability handling and the Annex VII file — with the IEC 62443 bridge built in.

See the CRA Workbench →

This page is general information about Regulation (EU) 2024/2847 and Commission Implementing Regulation (EU) 2025/2392, not legal advice. Quoted text is from the Official Journal; the analysis around it is ours. Classification turns on your product’s actual core functionality — document your own determination and confirm it against the current official texts. The CRA Workbench produces draft documentation for expert review; it indicates the evidence needed and does not, by itself, guarantee compliance.