EU cyber rules increase workload for machinery makers

New European Union cybersecurity rules will require all internet-enabled devices to meet stricter standards from September 11, increasing bureaucracy for machinery and plant manufacturers, ORF reports.

The Cyber Resilience Act applies not only to products such as smartwatches and washing machines, but also to industrial equipment. SW Automatisierung, a machinery manufacturer in Golling in the Tennengau region, has fitted its wire-processing machines with network connections for years. Customers can monitor and control the machines, while the company can service them remotely from Golling.

“We do not want to have machines at customers’ sites that do something foolish there, let alone cause a data leak,” said Stefan Neureiter, the company’s head of software development.

Under the new rules, internet-enabled products must be designed to resist cyberattacks, receive regular updates and allow security gaps to be closed. Companies must also consider how data is handled, said Simon Kranzer, a digitalisation expert at Salzburg University of Applied Sciences.

The risks are significant. Experts say at least one-third of companies have already been targeted by cyberattacks. SW Automatisierung was also affected after an undetected vulnerability in its IT system was exploited, managing director Felix Grünwald said.

The company escaped with limited damage, Grünwald said, but attacks can disable systems, remove data or lead to its misuse. More serious consequences could include ransom demands and even insolvency.

From September 11, security vulnerabilities must initially be reported within 24 hours. The aim is to ensure that everyone in the supply chain, from users to manufacturers, can respond quickly.

For small companies such as SW Automatisierung, which employs 45 people, the rule requires extensive preparation. Neureiter said about 20 percent of the software development team’s work was currently devoted to the issue, and that this would likely continue until the end of the year.

The rules must be fully implemented by the end of 2027. After that, only products meeting the required standard may be placed on the EU market. Fines could reach tens of millions of euros.