Crane Cyber Compliance: What Two EU Regimes Ask of a PLC-Controlled Crane, 2026 to 2028

Written by Chen Wei, Senior Design Engineer at SIEC Cranes. Oct 28, 2026.

Since 11 September 2026, anyone manufacturing a crane with a networked controller for the EU market has a legal duty to report actively exploited vulnerabilities inside that crane within 24 hours of learning about them. That clock started six weeks ago. The machinery safety rules most factories are still preparing for do not begin until 20 January 2027. The horizontal cyber rules that turn the whole thing into a CE marking file do not fully apply until 11 December 2027. Three dates, two regulations, one machine.

Most of the buyers we quote in Europe have heard of exactly one of these. Usually the Machinery Regulation, because that is what their notified body asks about. Almost nobody has asked us yet about the CRA reporting duty, and that is the one already running.

What are the two regimes, and why does a crane hit both?

Regulation (EU) 2023/1230, the Machinery Regulation, replaces the old Machinery Directive 2006/42/EC and applies to machinery placed on the market from 20 January 2027. It is a safety law that now contains a cybersecurity requirement. Annex III section 1.1.9 is titled "Protection against corruption": connections to other devices must not create hazardous situations, safety-critical hardware and software and data must be protected against accidental or intentional corruption and must be identified, and legitimate or illegitimate interventions must be recorded. Section 1.2.1 covers safety and reliability of control systems.

Regulation (EU) 2024/2847, the Cyber Resilience Act, is a product cybersecurity law. It entered into force on 10 December 2024. Chapter IV on notified bodies has applied since 11 June 2026. The reporting obligations started on 11 September 2026. The main obligations apply from 11 December 2027.

A PLC-controlled overhead crane is a machine under the first and a product with digital elements under the second. The Commission's own CRA FAQ is blunt about what that means. Question 2.4.1 says manufacturers of products that fall under both "should comply with both the essential cybersecurity requirements set out in this Regulation and the essential health and safety requirements set out in Regulation (EU) 2023/1230", and that any synergy "has to be demonstrated by the manufacturer". Question 2.4.3 goes further: conformity assessment under one instrument "cannot automatically be considered as sufficient to also satisfy the procedure that is required to be followed as per the other instrument".

Two files, two declarations, one crane. That is the shape of the problem.

Item	Machinery Regulation 2023/1230	Cyber Resilience Act 2024/2847
What it is about	Physical safety of the machine, plus protection against corruption of safety functions	Cybersecurity of the digital product across its whole life, including updates
Applies to a crane from	20 January 2027	11 December 2027 for main obligations, 11 September 2026 for incident reporting
Who assesses	Self-assessment for most cranes, notified body for Annex I listed machinery	Self-assessment by default, third party for "important products" in Annex III
Deliverable	Technical file, EU declaration of conformity, CE mark, instructions with residual risks	Technical documentation, EU declaration of conformity, CE mark, SBOM, support period, vulnerability process
Ongoing duty	Keep the file 10 years, act on incidents that reveal non-conformity	Handle vulnerabilities for the whole support period, report exploited ones in 24 hours

What is already live today, and what is still ahead?

This is the part that gets lost in the summaries. The CRA is not one deadline. It is a staircase, and the section that hurts a factory most is the one that is already in force.

Date	What applies	What it means for a crane maker
10 December 2024	CRA entered into force	Nothing operational, but the design clock starts
1 August 2025	Radio Equipment Directive cyber requirements (Delegated Regulation 2022/30)	Already hits every radio remote control shipped into the EU
11 June 2026	CRA Chapter IV, notified bodies	Third-party assessment becomes bookable
11 September 2026	CRA reporting obligations and the ENISA Single Reporting Platform	Already live. Applies to products already on the EU market, not only new ones
20 January 2027	Machinery Regulation 2023/1230	Annex III 1.1.9 and 1.2.1 become part of the CE file
11 December 2027	CRA main obligations	Full CE marking under the CRA, SBOM, support period declared in the instructions
11 December 2027	Reporting for open-source software stewards	Relevant only if you maintain a project you also sell commercially

The Commission's own announcement on 11 September 2026 spelled out the detail that catches people: the reporting obligations apply to all products with digital elements made available in the EU, "including those already on the market". A 2019 crane with a 4G diagnostics gateway that has been sitting in a Dutch plant for seven years is inside that sentence. The obligation attaches to the manufacturer, not to the year of sale.

What exactly has to be reported, and how fast?

Two categories, four clocks. An actively exploited vulnerability in your product and a severe incident affecting its security are different triggers, and they end on different deadlines.

Stage	Deadline	What goes in it
Early warning	24 hours from becoming aware	That a suspected exploitable vulnerability or severe incident exists, plus basic facts
Full notification	72 hours	General information on the product, the nature of the exploit or incident, and initial mitigation
Final report, exploited vulnerability	14 days after a corrective measure is available	Root cause, applied fix, affected versions, user actions
Final report, severe incident	1 month from the 72-hour notification	Same shape, plus what was done to stop recurrence

The filing route is one portal. ENISA built and operates the CRA Single Reporting Platform, operational since 11 September 2026. A manufacturer reports once. The platform routes the notification to the CSIRT of the member state where the manufacturer has its main establishment and, unless exceptional circumstances apply, makes the information available to ENISA at the same time. The receiving CSIRT then shares it with the other national CSIRTs where the product is sold.

There is a narrow door for delay. On 11 December 2025 the Commission adopted a delegated act setting the terms under which a CSIRT may hold back dissemination to other CSIRTs on justified cybersecurity grounds. Assume you will not qualify. Plan as if your customer's national authority learns on the same day you file.

For a factory in Zhejiang with no EU establishment, the practical question is who files. The regulation attaches the duty to the manufacturer, and a distributor or importer cannot absorb it. This is the single point where a European sales partner has to be brought into the conversation early, because the platform needs a named organisation with a working incident process behind it, not a sales office.

Which parts of a crane are products with digital elements?

More of the bill of materials than most quotations admit. The test is not "does it have a chip", it is whether the item is a software or hardware product that connects, directly or indirectly, to another device or network.

Component on a standard EOT crane	Product with digital elements?	Why it lands in the file
PLC / crane controller with Ethernet or fieldbus	Yes	Executes safety logic, connects to the plant network
Variable frequency drive with configuration software	Yes	Firmware, parameters that change braking and speed limits
HMI panel or touch screen	Yes	Runs an operating system, often with a web server
Remote diagnostics gateway, 4G router, VPN box	Yes, and usually an "important product"	VPN gateways and routers are named in Annex III Class I
Radio remote transmitter and receiver	Yes, and also radio equipment	Two regimes at once: RED cyber requirements plus CRA
Anti-sway or positioning controller	Yes	Firmware that directly commands motion
Load cell, load limiter display, overload protection	Yes when it processes and transmits data	A spoofed load signal defeats the machine's own protection
Bridge girder, end carriage, drum, hook block, wire rope	No	No software, no connection. Steel stays steel.

The list matters because the CRA does not ask you to certify each screw. It asks you to know which items are digital, who made them, which version they are on, and how a vulnerability in any of them gets fixed during the support period. That is an inventory problem before it is an engineering problem.

A standard single girder crane with a chain hoist and a pendant control usually carries three or four of these items. Add a remote diagnostics gateway and the count doubles. A hoist and accessory package sold separately brings its own declaration, because the hoist is its own product with digital elements when it ships with an inverter and a control board.

Is an overhead crane an "important product" under Annex III?

No. The Commission set out the technical descriptions of important products with digital elements in Implementing Regulation (EU) 2025/2392, and cranes are not in it. That is good news, because Class I and Class II products carry heavier conformity assessment routes.

But the components are a different story. The Class I list includes things that appear on crane BOMs every week:

Class I category in Annex III	Where it shows up on a crane
Products with the function of a virtual private network	The remote service tunnel you install so your engineer can log in from Zhejiang
Routers, modems intended for connection to the internet, and switches	The 4G router in the cabinet that gives the crane its SIM card
Physical and virtual network interfaces	Ethernet, Wi-Fi and fieldbus interface cards and adapters
Operating systems	The real-time OS or Windows build inside the HMI panel
Identity management and privileged access management	The remote-access account system used by your service team
Security information and event management systems	Only if you resell plant-level monitoring with the crane

Article 7(1) of the CRA protects you from a cascade: integrating a product that has the core functionality of a Class I or Class II category does not in itself drag the host product into those procedures. But you still have to ensure the supplier did its job, and if there is no declaration of conformity and no CE mark for that component, the responsibility for it is yours. Put that in the purchase order, not in a phone call.

How long must a crane be supported?

Five years is the floor, and for industrial equipment the recital tells you to go further. Recital 60 of the CRA says the support period should be no less than five years unless the product's lifetime is shorter, and adds that products "intended for use in industrial settings, such as industrial control systems, are often in use for significantly longer periods of time".

Read that next to a crane's real service life of 20 to 30 years and the gap is obvious. Nobody expects a 2027 PLC to receive patches in 2052. What the regulation expects is that you say, in writing, when the patches stop.

Annex II requires the end date of the support period to be given to the user together with the product. That single line in the instruction manual is what a maintenance manager will use to plan the retrofit, and it is what a market surveillance officer will read first.

Crane class and duty	Typical service life	Defensible declared support period
Light workshop crane, A3-A4, 1-10 t	15-20 years	5 years for the digital components, stated as such
Production crane, A5-A6, 10-50 t	20-25 years	8-10 years, with a documented controller upgrade path
Heavy or process crane, A7-A8, 50-100 t	25-30 years	10 years, plus a contractual migration window
Crane with radio remote only, no network	15-20 years	Support period set by the radio equipment, often 5-7 years

Those period ranges are our own planning assumptions from Chinese and European service records, not a published statistic. The five-year floor is law; everything above it is a commercial decision that should be made with the buyer before the order, because it is much cheaper to promise ten years with a controller roadmap than to argue about it in year six.

What goes into the technical file, and what is an SBOM?

The technical documentation requirement is the part that turns a factory's existing CE file into a working document. A crane file written for the old Machinery Directive typically contains drawings, calculations, risk assessment, test reports and a declaration. It almost never contains a component inventory with versions.

Item	What it looks like on a crane	Common gap today
General description and intended use	Capacity, span, duty class, environment, interfaces	Usually present, rarely mentions the network interface
Risk assessment including cyber risk	What happens to motion if a signal is spoofed or replayed	Missing. Safety risk assessment stops at mechanical hazards
Software bill of materials	Every third-party library and firmware version in the controller, HMI and gateway	Does not exist. Recital 77 expects one, and does not require it to be public
Vulnerability handling process	Who receives a report, who triages it, how a fix reaches a crane in Spain	Missing, and this is the clause a buyer's IT department will test
Secure update mechanism	Signed firmware, rollback, and a path that works without an internet connection	Usually a USB stick and an email, undocumented
Coordinated disclosure policy and contact	A public security contact, not a sales inbox	Missing, and it is the cheapest item on the list to fix

Two things are worth saying plainly about the SBOM. First, the regulation does not force you to publish it. Recital 77 says manufacturers "should not be obliged to make the SBOM public". Second, it is useless if it is compiled once. The value is in being able to answer, within a day, whether a library disclosed last week is inside your controller firmware. That is a database, not a PDF.

Who is legally responsible: the factory, the exporter, or the EU importer?

All three, in different ways, and the importer carries more than most Chinese suppliers assume. Under the CRA the importer is the EU entity that places a product bearing a non-EU manufacturer's name on the market. It has to verify that the manufacturer met the essential cybersecurity requirements and has vulnerability-handling processes in place, that the conformity assessment was carried out, that the technical documentation exists, and that the CE mark is affixed. An importer that does not do this is not a passive channel; it is a liable party.

The manufacturer may appoint an authorised representative inside the Union by written mandate to carry out specified tasks. It is optional, and it is not a substitute for the manufacturer's own obligations, but it is the mechanism that makes a 24-hour reporting duty survivable for a company whose engineers are asleep when Europe is awake.

Role	Core duty under the CRA	Where it usually breaks
Manufacturer	Design, conformity assessment, CE, documentation, support period, vulnerability handling, 24-hour reporting	No process that survives a weekend
Authorised representative	Tasks listed in a written mandate, typically authority liaison and documentation holding	Mandate signed but no technical capability behind it
Importer	Verify compliance, CE, documentation, and the manufacturer's vulnerability process before placing on the market	Treats the crane like any other machine and asks only for a CE certificate
Distributor	Check CE and declaration before making the product available, act if it is non-compliant	Stores a PDF, never checks the version

The penalties explain why importers are starting to ask. Article 64 sets administrative fines of up to EUR 15,000,000 or 2.5 % of total worldwide annual turnover, whichever is higher, for breaching the essential cybersecurity requirements and the manufacturer obligations. Documentation and procedural failures sit at EUR 10,000,000 or 2 %. Supplying incorrect, incomplete or misleading information to a notified body or a market surveillance authority sits at EUR 5,000,000 or 1 %.

Infringement	Maximum administrative fine
Essential cybersecurity requirements, manufacturer obligations	EUR 15,000,000 or 2.5 % of worldwide annual turnover, whichever is higher
Importer, distributor and other procedural obligations	EUR 10,000,000 or 2 % of worldwide annual turnover, whichever is higher
Incorrect, incomplete or misleading information to authorities	EUR 5,000,000 or 1 % of worldwide annual turnover, whichever is higher

For a mid-sized crane builder the percentage branch rarely bites. The EUR 15 million branch does not care about your headcount, and being told to withdraw a model from the EU market costs more than any fine.

Is the threat real, or is this paperwork?

Industrial control systems are not a theoretical target. The disclosure pipeline alone tells a story: the number of published industrial control advisories keeps rising, and the severity is rising with it.

Measure	Value	Source
ICS advisories published in 2025	508, covering 2,155 CVEs (first year above 500)	Forescout Research, February 2026, on CISA data
Average CVSS of those advisories	8.07, up 25 % from 6.44 in 2010; 82 % high or critical	Forescout Research, February 2026
Cumulative advisories since 2010	3,637 advisories, 12,174 vulnerabilities, 2,783 products, 689 vendors	Forescout Research, February 2026
OT devices containing known exploited vulnerabilities	12 % of more than 940,000 devices across 270 organisations	Claroty Team82, State of CPS Security 2025
Organisations with such devices exposed to the internet	40 %, rising to 31 % for the subset where the vulnerability is tied to ransomware	Claroty Team82, State of CPS Security 2025
Ransomware growth in manufacturing, 2024 to 2025	61 %, the largest increase of any critical sector	Claroty, 31 October 2025

Read the fourth and fifth rows together. Roughly four in ten of the plants surveyed had insecure remote access sitting on assets that already carried a known exploited vulnerability. That is exactly the arrangement created by a diagnostics gateway bolted onto a crane so the factory can help the customer without sending an engineer. The gateway is not the problem. The gateway with a shared password and no update path is.

What does a radio remote control have to prove now?

Radio remote controls reached this party first. Commission Delegated Regulation (EU) 2022/30 made the cybersecurity essential requirements in Article 3(3)(d), (e) and (f) of the Radio Equipment Directive mandatory for listed categories of radio equipment from 1 August 2025. A crane transmitter and receiver pair is radio equipment, so every handheld unit shipped into the EU since that date sits inside it.

The harmonised standards are EN 18031-1:2024 for internet-connected radio equipment and EN 18031-2:2024 for equipment processing personal data. They are cited in the Official Journal with restrictions, and one restriction is unusually concrete. The citation in Implementing Decision (EU) 2025/138 carries a notice that EN 18031-1 does not confer a presumption of conformity if, when applying its clauses 6.2.5.1 and 6.2.5.2, "the user is allowed not to set and use any password".

That single sentence disqualifies a lot of hardware. A transmitter shipped with a fixed pairing code and no requirement to set a password cannot lean on the harmonised standard. It does not automatically make the product illegal, but it removes the easiest route to demonstrating conformity, and a buyer's compliance department will find it.

Attack class against industrial radio remote control	What the attacker does	Question to put to the supplier
Capture and replay	Records a valid telegram and rebroadcasts it later to make the crane move	Is the link encrypted, and are telegrams protected against replay with a counter or timestamp?
Command injection	Decodes the telegram structure and substitutes a different command	Is there message authentication over the command payload, not only over the address?
Malicious re-programming	Rewrites the mapping between an operating element and a machine output	Can the firmware be written without a signed image and a physical service step?
Malicious re-pairing	Emulates the original transmitter so the receiver accepts a new one	Does pairing require physical access to the receiver and an authorised key?

The four attack classes above are the taxonomy used by HBC-radiomatic in its published white paper on security in industrial radio remote control, which also notes that the company has provided fully encrypted radio transmission for more than a decade and submits systems for external penetration testing where feasible. That is the standard a serious supplier now works to. It is also a reasonable benchmark for a buyer comparing a European remote against a cheaper one: the question is not whether the datasheet says "encrypted", it is which of the four classes is closed and how you would prove it.

What does IEC 62443 cost, and does it replace the CE work?

IEC 62443 is the industrial answer to "how do I show I did this properly", and it does not replace CE marking. It is a certification of your development process and your product's technical security requirements. The CE file still has to exist.

Three parts matter to a crane builder: 4-1 for the secure development lifecycle, 4-2 for the technical security requirements of the component, and 3-3 for the system. The published 2026 scheme fees and assessment ranges give a usable order of magnitude.

What is certified	Standard	Scheme fee	Assessment, typical range
Secure development lifecycle	62443-4-1	USD 1,500 per year	EUR 15,000-35,000 at maturity level 2
Component	62443-4-2	USD 1,200 per component or 1,500 per family, per year	EUR 25,000-50,000 on top of a certified 4-1 process
System	62443-3-3	USD 1,200 per year	EUR 30,000-50,000
First device certification, all-in	ISASecure scheme	Included above	USD 50,000-75,000, per the scheme's own FAQ

The standards themselves are the cheapest line and the one most often skipped. IEC sells each part separately: 62443-4-1 is CHF 335 and 62443-4-2 is CHF 405, so a product supplier's minimum set is CHF 740. The full set needed to understand what a plant will hold its service providers to is under CHF 3,000. Buying the standard is cheaper than paying a consultant to summarise it.

There is a second route that matters for the Machinery Regulation specifically. Certification under a cybersecurity scheme adopted under Regulation (EU) 2019/881 gives a presumption of conformity with Annex III sections 1.1.9 and 1.2.1 of the MR. The current scheme is the EUCC, established by Implementing Regulation (EU) 2024/482, applicable since 27 February 2025, with two assurance levels, "substantial" and "high". Self-assessment is not allowed under EUCC. For a crane builder that wants one certificate to serve both laws, that is the mechanism, and it is priced like a serious project rather than a document review.

What does compliance actually cost, per crane?

Nobody in this industry publishes a per-unit number, so here is ours. The figures below are SIEC planning estimates for a three-model range of PLC-controlled cranes, built from our own quotations for testing and documentation work. They are not a published statistic and they will move with the scope of the control system.

Work package	First year	Recurring
Threat model and cyber risk assessment added to the safety file	5-8 engineer-days	1-2 days per model change
SBOM build and refresh for controller, HMI and gateway	4-6 days	1-2 days per quarter
External penetration test of gateway and radio link	EUR 8,000-15,000	EUR 8,000-15,000 every 2-3 years
Documentation, declaration of conformity, instruction manual update	3-5 days	1-2 days per year
Vulnerability handling and 24-hour reporting duty	Process setup, 3-4 days	4-8 days per year plus on-call cover
Optional: EUCC or IEC 62443-4-2 certification	EUR 40,000-90,000	Scheme fees plus surveillance audit
Total without third-party certification	EUR 25,000-55,000	EUR 10,000-25,000 per year

Amortised over output, the picture changes completely. At forty cranes a year the first-year cost is EUR 625 to 1,375 per unit. At eight cranes a year it is EUR 3,100 to 6,900 per unit, which is the same order as the freight on a single 20 tonne machine. The recurring figure is what decides whether a small builder can stay in the segment: EUR 10,000 to 25,000 a year does not scale down with volume, so the fixed cost per crane rises as the order book shrinks.

The one line people underestimate is the reporting duty. A 24-hour clock means somebody has to be reachable at 3 a.m. European time from Zhejiang. In practice that means either a European service partner with an incident process, or a rota. Both cost money, and neither is on a quotation.

What should the RFQ say?

Buyers who understand the two regimes write different purchase orders than buyers who do not. These are the clauses we now see in European enquiries and the ones we would put in if we were on the buying side.

Clause	Wording that works
1. Inventory	List every product with digital elements in the crane, with make, model and firmware version
2. Declarations	Provide the CE declaration of conformity for each third-party item, or state in writing that none exists
3. Support period	State the support end date in the instruction manual and name the person responsible for it
4. Remote access	Outbound-only connection, no inbound port, per-site credentials, no shared service account
5. Radio link	Encrypted transmission, replay counter, mandated password on first use, physical pairing step
6. Updates	Signed firmware, documented offline update path, rollback procedure
7. SBOM	Deliver on request within five working days, under NDA, refreshed at each firmware release
8. Reporting	Notify the buyer within 24 hours of becoming aware of an actively exploited vulnerability affecting the crane
9. Escalation	Named security contact with a response time, not a general sales address
10. Change control	Any substitution of a controller, HMI or gateway requires written approval and an updated file

Clause 10 is the one that protects the buyer from the most common real-world failure. A controller gets swapped in the factory because of a supply delay, nobody updates the documentation, and eighteen months later the crane on site no longer matches the file that was declared. Under the Machinery Regulation that is a conformity problem. Under the CRA it is a documentation failure that sits in the EUR 10 million bracket.

What is the realistic timeline for a 2027 delivery?

Orders placed now land in the window where the two regimes overlap, and the sequence matters more than the paperwork.

Stage	Timing	What has to be ready
Order and design freeze	Q4 2026 to Q1 2027	Component inventory and supplier declarations fixed with the order, not after
Machinery Regulation applies	20 January 2027	Annex III 1.1.9 evidence: connectivity architecture, logged interventions, protected safety software
CRA reporting duty on existing fleet	Already live since 11 September 2026	A named contact and a written triage process for every connected crane already in the EU
CRA main obligations	11 December 2027	CRA conformity assessment, declaration, CE, SBOM, declared support period
First CRA audit cycle	2028	Evidence that the vulnerability process actually ran, not just that it was written

The practical consequence is that a crane delivered in the second half of 2027 has to satisfy the Machinery Regulation at delivery and will be inside the CRA regime within months. Designing the file once, for both, is cheaper than retrofitting one into the other. The control system is where the two overlap: 1.1.9 asks whether an intervention can corrupt a safety function, and the CRA asks whether you can find out about it and fix it.

What is the honest summary?

Crane cyber compliance is not a European trick to keep Chinese cranes out. It is a documentation and process law, and a factory that already builds a proper CE file is closer to compliance than the deadline suggests. What it does punish is the arrangement most exporters currently rely on: a third-party PLC and gateway, a shared password, an undocumented update path, and nobody who owns the question.

The report duty is the part to fix first, because it is already in force and it costs almost nothing to set up properly. A named contact, a short written triage process, and a rule that any customer report of unusual crane behaviour reaches that contact within the hour. That is a week of work. The alternative is discovering the obligation in the middle of an incident, with a 24-hour clock already running and an importer asking why they were not told.

Frequently Asked Questions

Does the Cyber Resilience Act apply to a crane that has no internet connection?

Yes, if any part of it is a product with digital elements that connects directly or indirectly to another device. A crane with a PLC and an HMI on a local network, with no route to the internet, is still in scope. The regulation covers indirect connection too, and a technician's laptop plugged into the cabinet is a connection. What changes without internet access is the practical risk, not the legal scope.

We only export through a European distributor. Does that make them the manufacturer?

No. If the crane carries your name or trademark, you are the manufacturer under the CRA, and the reporting duty is yours. Your distributor is an importer if they place the product on the market, which gives them verification duties but does not transfer your obligations. Putting your brand on the machine and your distributor's name on the paperwork does not move the liability.

Is a radio remote control covered twice, by the RED and by the CRA?

The radio remote is radio equipment and also a product with digital elements. The Radio Equipment Directive cyber requirements have applied since 1 August 2025 through Delegated Regulation 2022/30, with EN 18031-1 and EN 18031-2 as the harmonised standards. The CRA adds a separate horizontal layer covering the whole product and its lifecycle. Do not assume one certificate closes the other; the Commission's guidance on combining instruments is that the manufacturer must demonstrate the synergies.

What happens if we discover a vulnerability and cannot fix it within 72 hours?

You still notify. The 72-hour deadline is for the full notification, not for the fix. The final report on an actively exploited vulnerability is due no later than 14 days after a corrective measure is available, which is a different clock and recognises that a fix takes longer than a notification. What you must not do is wait for the fix before telling anyone.

Do we need IEC 62443 certification to sell into the EU?

No. IEC 62443 is not referenced as a harmonised standard giving automatic presumption of conformity under the CRA. What the Machinery Regulation does provide is that certification under a scheme adopted under Regulation (EU) 2019/881 gives a presumption of conformity with Annex III sections 1.1.9 and 1.2.1. IEC 62443 is the practical way to build the process, and a buyer may ask for it, but it is not the legal gate. For a hoist sold as a separate product, the same logic applies to its own controller and declaration.

We have cranes in Europe sold in 2018. Are we really exposed to a 2026 reporting duty?

Yes. The Commission stated on 11 September 2026 that the reporting obligations apply to all products with digital elements made available in the EU, including those already on the market. The duty attaches to the manufacturer, not the sale date. In practice, most 2018 cranes have no remote connection and no way for you to learn about an exploited vulnerability, which is an argument for documenting that fact rather than assuming the question will not be asked.