EU Cyber Resilience Act: Are Your Equipment Suppliers Ready?

The first major deadline was on September 11, 2026. From that date forward, manufacturers of products with digital elements, including industrial equipment containing PLCs, HMIs, and control systems, must report actively exploited vulnerabilities and severe security incidents on a strict timeline: an early warning within 24 hours, a detailed notification within 72 hours, and a final report within 14 days of a fix becoming available.

For terminal operators, that means supplier responsiveness will become more important than ever.

Many terminal facilities rely on equipment from multiple vendors. If a cybersecurity vulnerability is discovered in one of those systems, your ability to assess risk and take corrective action depends heavily on the information and support available from the manufacturer. A supplier that cannot quickly identify affected products, determine which software versions are in use, or provide remediation guidance could create significant operational challenges.

The answers may reveal whether a supplier is prepared for the new regulatory environment or still developing its approach.

Full CRA compliance takes effect on December 11, 2027. It applies to products placed on the EU market on or after that date; equipment already installed is pulled into full scope only if it is substantially modified afterwards. By then, manufacturers will need to provide documented cybersecurity processes, maintain an SBOM, declare a support period of at least five years, and make security updates available throughout that period, and affix CE marking with an EU Declaration of Conformity.

For terminal operators, this means cybersecurity support will increasingly become an important part of evaluating equipment suppliers, alongside performance, reliability, and cost.