Industrial

A machine with a controller is also a product with digital elements.

A line, a PLC, an HMI, a gateway - if you place it on the Union market as a product, CRA asks about design, components and maintenance. Industrial buyers do not want that file in someone else’s cloud.

Book a call

A line, a controller, an HMI, a gateway - if you place it on the Union market as a product, CRA asks about design, composition and maintenance through the support period. The machine lives a decade. The CVE does not. OT buyers do not want that file in someone else’s cloud.

The unit is the product, not the plant. Two control variants are two rows even if the cabinet looks the same. A substantial modification on a retrofit - a new protocol, remote access, a new runtime - is a new placing, not “service”.

Due diligence on PLCs, libraries and gateways stays with you, even if you never get the source. Crado AI sits on the plant network or in your IT: catalogue, supplier SBOM, risk, documentation.

What is a PDE in automation

A machine with digital elements

Control, HMI, drives with firmware that you sell as a product under your mark.

A controller or runtime sold separately

An automation component on the Union market is a PDE just like the whole line if it goes out under your name.

A gateway and remote access

Attack surface that appears in a retrofit changes the risk. That is a file event, not a commercial option.

A long support period

Month and year at acceptance. “Support until the line dies” with no date is not the period in the regulation.

Usual friction

A long machine life versus a short CVE cycle.
PLC components and libraries you do not have source for.
Market surveillance that can demand the file years later.

What Crado AI holds

A catalogue of products and control variants.
An SBOM with due diligence on automation suppliers.
A deployment only on the plant network or in your IT.

What usually hurts a machine

The controller lives 15 years. The CVE lives 15 days.
The PLC vendor will not give you source, and due diligence is still yours.
An authority can demand the file three years after line acceptance.

How CRA lands on OT

A catalogue of products and control variants, with market and placing-on-the-market date.
An SBOM with due diligence on PLC vendors and libraries, without pretending you have the source.
A risk assessment across the machine life, not a slide before FAT.
Article 14 on the product that stands at the customer: who knows in 24 hours which series has that runtime.
A file that stays available for years, on-premise, because market surveillance asks after acceptance, not on the ship date.

What to keep on the plant network

01

Variants, not only models

The same chassis, a different controller - another row, or a documented difference in the file.
02

Diligence on the component

Supplier, version, whether an SBOM exists, what you did when it did not.
03

Retrofit as a change

New remote access or a new protocol opens Annex I again.
04

Export without a cloud

The authority gets the file from your network. Control composition does not ride to someone else’s tenant.

Questions from automation

Does CRA replace the Machinery Directive?

No. It is a separate, horizontal product-cybersecurity rule. A machine with digital elements can carry both regimes. The CRA file is not the machinery declaration, and the other way around.

The PLC vendor will not give an SBOM. Then what?

Due diligence stays with you. You describe the component, the version, the gap in knowledge and what you did about it. A missing supplier file does not cancel the duty.

The line has stood since 2022. Does 2027 not apply?

New placing and substantial modification do. Article 14 from September 2026 covers notifications on products you are the manufacturer for. You still need the catalogue to know what you still place on the market.

Why on-premise only?

Control composition and gaps on the line are plant data. Crado AI has no SaaS plan.

What counts as a product with digital elements ->