-
Your shopping cart is empty!
Your shopping cart is empty!
The EU Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, makes cybersecurity mandatory for digital products sold in the European Union, including industrial robots. Its reporting obligations apply from 11 September 2026 and its main obligations apply from 11 December 2027. This guide explains what the CRA asks for, how a robot maker such as Universal Robots proves it, and four ways the rules can reach a Malaysian machine maker or system integrator.
By Jacky Lim, Professional Engineer registered with the Board of Engineers Malaysia, FA Controls Sdn Bhd. Last updated 2 November 2026.
Disclosure: I work at FA Controls Sdn Bhd, which has been the official Universal Robots (UR) distributor in Malaysia since 2016. I use UR as the worked example because its published papers explain how a robot maker complies. UR is a robot maker, so ask for proof on any claim that matters to you. The facts about UR and the EU rules come from the sources listed at the end. UR's papers do not mention Malaysia, so the four ways and the four steps below are my own reading and experience.
The CRA is EU Regulation 2024/2847. It makes cybersecurity mandatory for digital products sold in the EU, and that includes industrial robots.
A simple way to see it is as the CE mark for cybersecurity. A product must meet safety standards to carry the CE mark, and it will now need to meet cybersecurity standards too.
| Date | What happens | Source |
|---|---|---|
| 10 December 2024 | The CRA entered into force. | European Commission |
| 11 September 2026 | The CRA reporting obligations apply. | European Commission |
| 20 January 2027 | The EU Machinery Regulation (EU) 2023/1230 takes effect, with cybersecurity requirements for safety related systems. | UR Cybersecurity Fact Sheet v10.0 |
| 2027 (planned) | UR plans IEC 62443 Part 4 2 for PolyScope X. | UR Cybersecurity Fact Sheet v10.0 |
| 11 December 2027 | The CRA main obligations apply to products placed on the EU market. | European Commission, UR papers |
| In force now | NIS2 applies to affected operators of equipment. | UR papers |
Universal Robots states that existing robots already in operation are not affected by the CRA. The CRA reporting obligations started on 11 September 2026, so ask a qualified adviser whether they reach products you placed on the market earlier.
UR's papers group the CRA requirements into six areas. The table shows each one and how a robot maker meets it. My example is UR and its newer software, PolyScope X.
| Requirement area | How UR meets it (from UR's papers) |
|---|---|
| 1. No known exploitable weaknesses when the product ships | UR scans for weaknesses all the time and tracks known ones automatically. |
| 2. Secure by default, with no default passwords | The newer software switches off insecure services from the start. |
| 3. A documented way to find, fix and disclose security issues | UR follows a certified process for this. |
| 4. Security updates through the product's life | The newer software keeps the operating system separate from the application, so updates do not disrupt the robot's work. |
| 5. Encryption of data stored and in transit | The maker encrypts critical communication, and protects the hardware in a physical enclosure. |
| 6. A software bill of materials (SBOM) | A full list of every software component inside the product. UR keeps one for the newer software. |
The regulation itself sets out the full list of requirements. Read the official text for your own case.
A maker proves it with independent certificates. Ask which part of a standard a certificate covers.
| Standard part | What it covers | UR status (UR Cybersecurity Fact Sheet v10.0, August 2026) |
|---|---|---|
| IEC 62443 Part 4 1 | The maker's software development process. | Certified by TÜV Rheinland, an independent body. UR says the certificate is available on request. |
| IEC 62443 Part 4 2 | What the product itself can do. | Planned for PolyScope X in 2027. Today it is a plan, not a certificate. |
When a supplier says certified, ask which part, and ask to see it.
Two more rules sit beside the CRA. The EU Machinery Regulation is about the machine. It takes effect on 20 January 2027, and requires safety related systems to be protected from intentional corruption, including cyberattacks.
NIS2 is about the company that operates the equipment, and it is already in force for affected operators.
UR's papers do not mention Malaysia, so this is my own reading. I see four ways the rules can reach a Malaysian machine maker or system integrator.
This way is about the law on your product. The CRA applies to products placed on the EU market. So ask: does any product or machine we build end up there? Who counts as the maker of a machine is a legal question that UR's papers do not answer, so check it for your own case.
This way is about your customer's rule, not the law on your product. Large enterprises now pass cybersecurity requirements down to their equipment suppliers. In my experience, a major multinational will ask the equipment manufacturer for an official declaration on security concerns. One example is no transfer of data from the equipment to an external server.
This way is not about the EU market. ISO 10218 Part 1, the international robot safety standard, asks in its 2025 edition for a security assessment where a cyber threat can create a safety risk. That applies wherever your machine is sold.
The robot maker protects the robot itself. You assess and control the cyber risk in your application. In my view, the robot maker's CRA documents are a useful reference for that assessment. A secure robot does not make a secure machine. The customer and the integrator complete the rest.
For large manufacturers and distributors, robot cybersecurity is now part of approval, compliance and uptime planning. Their security teams would rather review recognised proof than rely only on supplier claims.
Which of your products or machines go to the EU market, and which customers operate there?
Ask every supplier the same five questions:
Cyber risk matters most when the robot system connects to the client's network or server. So integrators must start a meeting with the client's IT team, align the requirements from both sides, and put the security features in place. Then the basics:
UR itself says its older software, PolyScope 3 and PolyScope 5, cannot be updated to meet the CRA. Robots already running are not affected. In my view, if you want to repurpose an older robot, do it before the date. New robots sold into the EU after the date will need PolyScope X.
For PolyScope 3, isolate it and plan its replacement, starting with the applications that carry the highest risk. For PolyScope 5, harden it now and plan the move when the timing is right.
The CRA is EU Regulation 2024/2847. It makes cybersecurity mandatory for digital products sold in the EU, and that includes industrial robots. A simple way to see it is as the CE mark for cybersecurity. A product must meet safety standards to carry the CE mark, and it will now need to meet cybersecurity standards too.
According to the European Commission, the CRA entered into force on 10 December 2024. Its reporting obligations apply from 11 September 2026, and its main obligations apply from 11 December 2027.
The CRA applies to products placed on the EU market. Universal Robots' papers do not mention Malaysia. A Malaysian company can be reached when its product or machine is sold into the EU, when an EU customer asks for proof, through the security assessment in ISO 10218 Part 1 (2025 edition), or when a customer asks for cybersecurity proof whatever the law says. Who counts as the maker of a machine is a legal question, so check it for your own case.
Universal Robots states that existing robots already in operation are not affected by the CRA. The CRA reporting obligations started on 11 September 2026, so ask a qualified adviser whether they reach products you placed on the market earlier.
Universal Robots' papers group the requirements into six areas: no known exploitable weaknesses when the product ships, secure by default with no default passwords, a documented way to find, fix and disclose security issues, security updates through the product's life, encryption of data stored and in transit, and a software bill of materials. The regulation itself sets out the full list, so read the official text for your own case.
A software bill of materials is a full list of every software component inside a product. It is one of the six requirement areas, and Universal Robots keeps one for PolyScope X.
A maker proves it with independent certificates. IEC 62443 Part 4 1 covers the maker's software development process, and TÜV Rheinland, an independent body, has certified the process of Universal Robots. Part 4 2 covers what the product itself can do, and Universal Robots plans it for PolyScope X in 2027. When a supplier says certified, ask which part, and ask to see it.
The CRA is about the digital product. The EU Machinery Regulation is about the machine. It takes effect on 20 January 2027 and requires safety related systems to be protected from intentional corruption, including cyberattacks. NIS2 is about the company that operates the equipment, and it is already in force for affected operators.
Universal Robots says its older software, PolyScope 3 and PolyScope 5, cannot be updated to meet the CRA, and that robots already running are not affected. In my view, new robots sold into the EU after 11 December 2027 will need PolyScope X. For PolyScope 3, I suggest you isolate it and plan its replacement. For PolyScope 5, I suggest you harden it now and plan the move when the timing is right.
Last updated 2 November 2026. Dates and rules change, so check the official text before you act.
This post is general information, not legal advice. Check the official EU text and ask a qualified adviser for your own case.
Jacky Lim is a Professional Engineer registered with the Board of Engineers Malaysia and a Technology Professional registered with MBOT. He is Sales General Manager at FA Controls Sdn Bhd, where he works on robotics automation and AI vision systems for manufacturers, including semiconductor manufacturers. He contributes to AI standards for Malaysia through MTSFB SG4.
Need help working out where the CRA reaches your robot systems? Contact FA Controls Malaysia at sales@fa.com.my.
Leave a Comment