The EU Cyber Resilience Act, or CRA, is often described as an EU regulation. For UK manufacturers and technology suppliers, that description is technically correct but commercially incomplete.
The UK is no longer part of the EU regulatory framework post-BREXIT, but UK companies continue to design, manufacture and supply products into European markets. For manufacturers of industrial automation and control system products, the practical question is therefore not simply, “Does the EU CRA apply in the UK?” The more important questions are:
- Does the UK sell products in the EU?
- Does the product fall within the CRA’s definition of a product with digital elements?
- Are customers going to expect CRA-aligned security even where the legislation does not directly apply?
- What evidence can be provided about secure development, vulnerability management and cybersecurity support?
- And perhaps most importantly, are existing product security and supply chain assurance processes good enough for the world into which we are moving?
These questions are particularly relevant to the industrial sectors. Programmable logic controllers (PLCs), SCADA systems, industrial controllers, gateways, human-machine interfaces (HMIs), engineering software, network equipment and other connected industrial products increasingly sit at the intersection of product engineering, cybersecurity and operational resilience.
Does the EU CRA matter if I am a UK supplier?
For a UK manufacturer, the answer depends heavily on where the product is placed on the market.
Several international system integrators supply industrial control systems (ICS) and integrated control and safety systems (ICSSs) that have engineering design centers in the UK. Components with digital elements (like PLCs, engineering workstations, operator consoles, smart lab devices (pharma sectors), network switches, firewall appliances and industrial network sensors are assembled and packaged together as an ICS and supplied to customers in the UK—and many times also to EU nations.
EU Cyber Resilience Act Regulation (EU) 2024/2847 establishes cybersecurity requirements for hardware and software products with digital elements made available on the EU market. It entered into force in December 2024, with most of its requirements becoming applicable beginning 11 December 2027. Additionally, it places stringent vulnerability management requirements and serious incident reporting requirements under Article 14 that were applied on 11 September 2026 [1].
That creates a very important distinction for UK suppliers.
A UK company selling an industrial product exclusively into the UK is not automatically subject to the EU CRA simply because the product contains software or connects to a network. However, the situation changes when that same product is placed on the EU market. For an industrial manufacturer, this could include a PLC, industrial computer, network appliance, remote access gateway, HMI, software package or other product with digital elements. The precise classification depends on the product, its intended purpose, how it is placed on the market and whether another piece of EU legislation already covers it.
The CRA also introduces more than a one-off product compliance exercise. Manufacturers have obligations covering cybersecurity risk assessment, secure design and development, continuous vulnerability handling, security updates, technical documentation and information provided to users [1].
For UK manufacturers with a significant EU customer base, creating a robust single cybersecurity process may be the best possible strategy. It would not make commercial sense for product suppliers and system integrators to operate a lower product security standard for the UK than for the EU. That is where the CRA starts to influence the UK market, even where UK law does not directly require compliance.
The UK already has product cybersecurity legislation, but it is different
The Product Security and Telecommunications Infrastructure Act 2022 (PSTI), together with the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023, introduced a mandatory product security regime for consumer connectable products in the UK. The regime came into force on 29 April 2024 [2]. The legislation is aimed at consumer connectable products rather than industrial automation products generally.
This distinction matters.
A connected domestic camera, smart speaker, smart television, smartphone or other consumer internet of things (IoT) device may fall within the PSTI regime. The fact that an electrical product is sold in the UK does not, by itself, mean that PSTI applies to it.
The legislation focuses on relevant connectable products and places obligations on manufacturers, importers and distributors. Among other things, the regime addresses requirements around passwords, vulnerability reporting and transparency about security update support. Products must also be accompanied by a statement of compliance [2], [3]. The UK, therefore, has already moved from voluntary principles toward mandatory baseline security for a defined class of connected consumer products.
But there is a significant gap between this approach and the broader scope of the EU CRA. The PSTI regime is primarily concerned with consumer connectable products. The EU CRA is a horizontal product cybersecurity regulation covering a much broader range of hardware and software products with digital elements, including products used in industrial environments, subject to the regulation’s scope and exclusions. For UK IoT product manufacturers, that distinction is important.
Where does ISA/IEC 62443 fit?
For the industrial automation sector, the UK and European regulatory discussion should not be taking place in isolation from ISA/IEC 62443. ISA/IEC 62443 has been addressing industrial cybersecurity for many years and provides a useful framework for dividing responsibilities between asset owners, service providers and product suppliers.
Two standards are particularly relevant when discussing the EU CRA from an OT product perspective.
ISA/IEC 62443-4-1: Secure product development lifecycle
ISA/IEC 62443-4-1 specifies requirements for a secure development lifecycle for products used in industrial automation and control systems. It addresses areas including security requirements definition, secure design, secure implementation, verification and validation, defect management, patch management and product end of life [4].
This is highly relevant to the CRA because cybersecurity cannot realistically be added to an industrial product at the end of the engineering lifecycle. For a manufacturer, the important question is not simply: “Have we tested the product for vulnerabilities?” It is: “Can we demonstrate that security was systematically considered throughout the product lifecycle?” That includes threat modeling, security requirements, risk assessments, secure-by-default architecture, secure coding practices, security verification, vulnerability handling, patch management and end-of-life planning. It is fundamentally a product engineering issue as much as it is a cybersecurity issue.
ISA/IEC 62443-4-2: Technical security requirements for IACS components
ISA/IEC 62443-4-2 takes a different but complementary perspective. It defines technical security requirements for IACS components and relates them to the seven foundational requirements of the ISA/IEC 62443 framework:
- Identification and authentication control
- Use control
- System integrity
- Data confidentiality
- Restricted data flow
- Timely response to events
- Resource availability [5]
For a digital product supplier, this provides a technical framework for discussing the security capabilities of components such as embedded devices, network components, host components and software applications.
The combination is powerful.
- ISA/IEC 62443-4-1 asks, in effect, how the product is securely developed and maintained.
- ISA/IEC 62443-4-2 asks what security capabilities the component should provide.
- The EU CRA, meanwhile, turns product cybersecurity into a legal requirement for products within its scope.
The CRA is legislation, whereas ISA/IEC 62443 is an international standards framework. There is considerable overlap, but the conformity mechanisms and legal obligations are different. The context and environment in which the ICS is deployed and operated change the compliance.
For industrial manufacturers already using ISA/IEC 62443, however, the standard provides a very strong foundation from which to address CRA requirements.
What does this mean for UK OT manufacturers?
For UK manufacturers supplying industrial products into Europe, I believe the biggest change is cultural rather than purely regulatory. Product cybersecurity is moving from being something that a cybersecurity team checks before release to becoming part of the product lifecycle itself. Engineering, product management, software development, functional safety, quality, procurement, cybersecurity and after-sales support increasingly need to work together.
A manufacturer should be able to answer questions such as:
- What assets and interfaces do the product expose?
- What threats were considered during product development?
- What security requirements were defined?
- How were those requirements verified?
- What vulnerabilities have been identified?
- How can product suppliers report vulnerabilities?
- How quickly will vulnerabilities be assessed?
- What security updates will be provided?
- How long will the product be supported?
- What happens when the product reaches the end of life?
- What third-party software and open-source components are incorporated?
- How are software dependencies tracked?
- What security requirements are imposed on suppliers?
- What evidence can be provided to customers?
The above are key questions for industrial products that are expected to remain operational for 10, 15 or even 20 years. The technical life of an industrial product can be considerably longer than the commercial life of the company, software platform or individual engineers who originally developed it. That creates a fundamental OT cybersecurity challenge.
Supply chain assurance: Are we asking the right questions?
This is the area where I believe the industry needs to change most. Supply chain assurance has traditionally focused heavily on the organization supplying the product or service. Procurement teams may ask whether a supplier has ISO 27001, Cyber Essentials, Cyber Essentials Plus, SOC 2, security policies or an incident response plan. These controls can be valuable. But they do not necessarily tell us whether the product being purchased is secure. A supplier can have a mature corporate cybersecurity program and still deliver a product with vulnerabilities. Conversely, a highly capable industrial product manufacturer may have a relatively small corporate IT environment while operating a mature product security lifecycle.
We need to distinguish between “Is the supplier secure?” and “Is the product secure?”
They are different questions.
The National Cyber Security Center’s (NCSC’s) supply chain guidance recognizes this broader problem. Its 12 principles emphasize understanding the risks posed by suppliers, establishing minimum security requirements, embedding security into contracting, building assurance activities into supply chain management and continuously improving security [6]. The NCSC also specifically cautions against treating security simply as a product assurance issue and recommends engaging suppliers earlier in the process [7]. This is particularly relevant to critical infrastructure sectors.
From supplier assurance to product assurance
In my view, a more mature OT procurement process should consider at least four layers of assurance.
Layer 1: Supplier security
Does the supplier operate an effective cybersecurity management system?
This is where frameworks such as ISO 27001 and NIST Cybersecurity Framework can provide useful guidance.
Layer 2: Secure product development
Does the supplier have a repeatable, secure development lifecycle?
This is where ISA/IEC 62443-4-1 becomes particularly relevant.
Layer 3: Product security capabilities
Does the actual product or component provide the security capabilities required for its intended environment and risk profile?
ISA/IEC 62443-4-2 provides an important framework for product security assessment. ISA/IEC 62443-3-3 provides an important framework for system security assessment.
Layer 4: Lifecycle and vulnerability management
What happens after the product is deployed?
Suppliers and end user organizations (i.e., asset owners and operators) should understand and agree on vulnerability disclosure arrangements, security update processes, support periods, incident notification, patch management, third-party dependencies and end-of-life arrangements.
This fourth layer is particularly important for OT and industrial internet of things (IIoT) because “product delivery” is often the beginning rather than the end of the cybersecurity relationship.
What should UK customers be asking their suppliers?
The arrival of the EU CRA provides an opportunity for UK asset owners and operators to raise their expectations even where they are not legally required to do so. Instead of simply asking whether a product is compliant with ISA/IEC 62443, customers should consider asking:
- What ISA/IEC 62443 processes are implemented?
- Is ISA/IEC 62443-4-1 used as part of your secure development lifecycle?
- Which ISA/IEC 62443-4-2 security capabilities does the product provide?
- What security level capability has been designed into the component?
- How are vulnerabilities identified, assessed and disclosed?
- How can customers report vulnerabilities?
- What is the expected security support period?
- How frequently are security updates released?
- What third-party and open-source components are used?
- Is a software bill of materials (SBOM) available?
- How are vulnerabilities in third-party components managed?
- What happens when the product reaches the end of support?
- What cybersecurity responsibilities remain with the customer?
- What evidence can you provide to demonstrate your claims?
These questions are more useful than simply requesting a certificate and putting it in a procurement folder.
The bigger question for the UK and international suppliers
The EU CRA is likely to change customer expectations beyond the EU. A UK industrial manufacturer that supplies to the EU may decide to adopt the CRA requirements across its product portfolio rather than maintain different development and vulnerability management processes for different markets. UK asset owners may increasingly expect their suppliers to demonstrate equivalent levels of product security even when the product is purchased solely for deployment in the UK.
This could be one of the most significant impacts of the CRA. Regulation can influence procurement expectations well beyond the jurisdiction in which it was written. For critical infrastructure sectors like energy, renewables, transportation, oil and gas, manufacturing and automotive, that may actually be beneficial. In the UK, under the Network and Information Systems (NIS) Regulation, banks also fall within the purview and building automation systems in data centers become relevant critical infrastructure, where mandating compliance to the EU CRA becomes relevant.
For many years, cybersecurity assurance has sometimes concentrated on the security of the organization buying or operating the technology, while product security has received less consistent attention.
Conclusion
There appears to be a clear shift from supplier security to product security by adopting the ISA/IEC 62443 standards. Mandating EU CRA-compliant products and systems will only improve operational resilience and reduce supply chain risks. Cybersecurity must become an engineering characteristic of the product, supported by evidence throughout its lifecycle.
The EU CRA should not be viewed simply as another compliance obligation for UK manufacturers. For UK OT suppliers, it represents a broader shift in expectations around product cybersecurity.
- ISA/IEC 62443 provides the industrial automation community with an established framework for secure product development and technical security capabilities. Used together, they can forge a coherent security strategy.
- For industrial manufacturers and system integrators, ISA/IEC 62443-4-1 provides a strong foundation for building cybersecurity into the product development lifecycle. ISA/IEC 62443-4-2 provides the technical language for defining and assessing component security capabilities.
- The EU CRA then adds something different: a legal obligation for products within its scope that are placed on the EU market.
The real opportunity for the UK is to move beyond compliance-driven supplier questionnaires and toward meaningful product security assurance. A procurement questionnaire completed once every three years is unlikely to provide sufficient assurance for a PLC, safety controller, remote access appliance or engineering platform that will be connected to a critical production environment for 15 to 20 years.
We need to move toward lifecycle assurance. That means asking suppliers not only how secure their organization is today, but how they will manage product security throughout the expected operational life of the product. For an OT asset owner buying a product that may control a process for the next 15 or 20 years, the question should not simply be:
“Does this supplier have a cybersecurity certificate?”
It should be:
“Can this supplier demonstrate that the product will be developed, maintained, supported and secured throughout its operational life?”
That is a much harder question.
References
- European Commission, Cyber Resilience Act, Regulation (EU) 2024/2847. The EU Commission’s CRA summary describes the scope, manufacturer obligations, cybersecurity risk assessment, vulnerability handling, conformity assessment and implementation timetable.
- UK Government, “Product Security and Telecommunications Infrastructure Act 2022,” Part 1. The Act establishes the UK’s product security regime for relevant consumer connectable products and creates duties for manufacturers, importers and distributors.
- UK Government, “Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023.” These regulations establish the mandatory baseline security requirements applying to relevant consumer connectable products.
- ISA/IEC 62443-4-1:2018, Security for Industrial Automation and Control Systems – Part 4-1: Secure Product Development Lifecycle Requirements.
- ISA/IEC 62443-4-2:2019, Security for Industrial Automation and Control Systems – Part 4-2: Technical Security Requirements for IACS Components.
- UK National Cyber Security Centre, “Principles of Supply Chain Security.” The NCSC’s 12 principles cover understanding supply chain risk, establishing control, assurance and continuous improvement.
- UK National Cyber Security Centre, “Assessing Supply Chain Management Practice.” The guidance recommends engaging suppliers on security earlier and avoiding an approach where security is treated purely as a product assurance exercise.
