Numerous harmonised standards have not yet been published

We provide proactive, transparent and continuous information as soon as relevant news is available.

Status: August 2026

Why the CRA is coming:

A ransomware attack occurs every 11 seconds worldwide. The resulting damage runs into the billions every year. To counteract this, the EU Parliament passed the Cyber Resilience Act (CRA) in October 2024.
From December 11, 2027, new products with digital components must meet the CRA requirements. The deadline for manufacturers to fully implement all requirements ends on this date.
The CRA obliges manufacturers to, among other things

• ensure cyber security throughout the entire product life cycle
• continuously rectify known vulnerabilities
• document clear security processes
• comply with technical standards

Products without CRA conformity can no longer bear the CE marking and may therefore no longer be sold in Europe.

State of regulation:

• The BSI has announced that it will become the market surveillance authority for the CRA in Germany.
  Source: https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2025/251007_CRA_BSI_marktueberwachende_Behoerde.html
• The scope of the CRA is very comprehensive and affects almost all products with digital components.
• European standardisation is still ongoing. Numerous harmonised standards for the industrial sector have not yet been published in their final form.
  Source: https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/CRA/Dashboard_CRA.pdf?__blob=publicationFile&v=5

Due to standardisation and evaluation processes that are still ongoing, it is currently only possible to a limited extent to make a definitive assessment of full CRA compliance for many product categories.

What Wachendorff Automation is already doing:

We prepare our products well in advance to meet the CRA’s requirements. To this end, we work closely with our technology partners and suppliers and are gradually adapting our internal development and security processes.

Technical preparation of our products

• Analysis of all digital components in our products, for example encoders (firmware, interfaces, update processes)
• Establishment of secure software and firmware lifecycles, including vulnerability management
• Preparation for future disclosure requirements such as SBOMs

Transparent communication

• European standardisation relating to the Cyber Resilience Act has not yet been finalised. Therefore, many requirements cannot yet be fully assessed.
• We will provide proactive and ongoing updates as soon as binding requirements are published.