EU Cyber Resilience Act Guide for Robotics & Collaborative Robot Manufacturers

Industrial robots, collaborative robots (cobots), autonomous mobile robots (AMRs), robot operating system (ROS)-based platforms, and robotic management software are products with digital elements within CRA scope when they include network interfaces, remote management capabilities, or software that receives external updates.

Network-connected robots that can receive remote programming instructions, transmit production telemetry, or accept over-the-air firmware updates fall into Important Class I under Annex III — particularly where the robot performs functions directly adjacent to human workers (cobots) or manages safety-critical production processes. The Machinery Regulation (EU 2023/1230), which entered force in January 2024, governs the mechanical and functional safety of robotic systems; the CRA governs the cybersecurity of the digital elements within those systems. Both regulations apply concurrently — CE marking for robots must satisfy both.

Robotic systems present unique Annex I challenges because cybersecurity failures can have direct physical safety consequences — unauthorised manipulation of a robot's motion parameters can injure workers or damage equipment:

• Authenticated control interfaces: All interfaces accepting motion commands, program uploads, or configuration changes must require strong authentication. Remote programming APIs must not accept unauthenticated commands.
• Integrity-protected firmware: Robot controller firmware must be cryptographically signed and verified. Firmware downgrades to known-vulnerable versions must be prevented.
• Network segmentation support: Robots must support operation in segmented OT networks. Management interfaces must be separable from production data interfaces.
• Fail-safe behaviour: If network connectivity or authentication mechanisms fail, the robot must default to a safe state — not a state that allows unrestricted operation.
• Audit logging: All programming events, parameter changes, operator logins, and remote access sessions must be logged with timestamps and attribution.

Robotics manufacturers typically focus security resources on functional safety (ISO 10218, ISO/TS 15066 for cobots) rather than cybersecurity, and many lack formal CVD policies. Article 13 requires a publicly accessible CVD policy covering all products with digital elements — including robot controllers, programming pendants, and fleet management software.

• Define a clear scope covering all network-connected robotic products
• Specify a secure submission channel for researchers and operators
• Include a commitment to prioritising vulnerabilities that could affect worker safety
• Coordinate with customers (factory operators) before public disclosure, given that unpatched robot vulnerabilities in production environments represent an immediate occupational safety risk

CVD Portal can serve as the intake channel for the CVD policy, with triage functionality that supports escalation of safety-critical disclosures to immediate internal response.

Active exploitation of robotics vulnerabilities is a relatively novel threat scenario, but the consequences — production disruption, physical injury, corporate espionage via manufacturing data theft — make Article 14 compliance critical. The 24-hour ENISA notification requirement applies when exploitation is confirmed.

• Unauthorised remote access to production robots used for corporate sabotage or data exfiltration
• Ransomware deployment targeting robot controllers to disrupt production
• Manipulation of robot program parameters by an insider or external attacker

Manufacturers should establish monitoring capabilities — ideally in coordination with their industrial operator customers — that can detect exploitation signals. The 24-hour notification to ENISA must identify the affected product, the nature of the exploitation, and any immediate mitigations such as isolating affected systems from the network. Parallel notification to affected factory operator customers is essential given production safety implications.

Class I robotic products with digital elements require third-party CRA conformity assessment. Manufacturers who have already engaged a notified body for Machinery Regulation assessment should investigate whether the same body is accredited for CRA conformity assessment, potentially enabling a coordinated assessment programme.

1. Annex I Part I cybersecurity requirements for the digital elements (controller software, remote interfaces)
2. Annex I Part II vulnerability management — SBOM, patch process, CVD policy
3. The relationship between cybersecurity measures and functional safety measures (the two must not conflict)
4. Technical file completeness

Robotics manufacturers should note that IEC 62443 (industrial cybersecurity) provides a directly applicable framework for robot controller cybersecurity that aligns with CRA Annex I. Vendors investing in IEC 62443-4-2 component certification should position this as CRA conformity supporting evidence.