Placing on the market in plant engineering: which date decides CRA applicability

„We deliver in partial shipments across two years – so when exactly is the plant placed on the market?" For machine and plant builders, more hangs on this question than a formality. It decides whether a running project falls under the Cyber Resilience Act in full – and because the lead time for compliant software in plant engineering runs to roughly a year, the answer has to be settled long before delivery.

None of the relevant sources answers the question cleanly for plant engineering. Only the frame can be established, and it is tighter than the prevailing practice assumes.

The CRA has a single trigger

Article 3 defines two terms. Point 22 defines making available on the market as the supply of a product with digital elements for distribution or use on the Union market in the course of a commercial activity, whether for payment or free of charge. Point 21 defines placing on the market as the first making available of that product on the Union market.

The full text of the regulation (recitals, 71 articles, annexes) nowhere defines putting into service or attaches an obligation to it; the term appears only in passing, in the user information (Annex II point 8) and in the EU type-examination procedure (Annex VIII). The Machinery Regulation defines it expressly in Article 3(13) as first use for the intended purpose. On this point the CRA is thinner than the rest of product law, and that has a practical consequence: acceptance, commissioning, transfer of risk and production release carry no independent legal weight under the CRA. They serve as evidence of when first making available occurred – they do not constitute the trigger.

A 2025 contract does not protect a 2028 delivery

Article 71 sets CRA application at 11 December 2027; the reporting duty under Article 14 bites earlier, from 11 September 2026. Article 69(2) exempts products placed on the market before 11 December 2027 from the requirements – but only for as long as they undergo no substantial modification after that date. Paragraph 3 carves the reporting duty back out: it applies to all products in scope, including those delivered before the cut-off.

There is no grandfathering keyed to order date, project start or design freeze. Signing in 2025 and delivering in 2028 means delivering under the full CRA regime. The Commission's Blue Guide requires two things for a placing on the market: an offer or agreement on the transfer of ownership or possession, and a completed manufacturing stage. An offer concluded before manufacture is finalised is therefore not a placing on the market; the example the Blue Guide chooses is the plant engineering case itself: an undertaking to manufacture a product to agreed specifications, to be produced and delivered later.

The final delivery milestone is the only documented date

In projects with partial deliveries spread over 12 to 24 months, plant builders routinely set the date of placing on the market at the final delivery milestone. The reasoning is commercial: that is where revenue is recognised, and under commercial law that presupposes engineering is complete. The security concept is treated as completed along with it. At one film extrusion plant builder working at this scale, it is the only point at which a hard date, evidenced in the project file, is available without extra effort.

The milestone meets the condition the Blue Guide does impose, namely completed manufacture, and it is documented; in a dispute that counts for more than an assessment reconstructed after the fact. As a working hypothesis the choice holds, as legal certainty it does not.

A plant can have several dates of placing on the market

The Blue Guide holds that placing on the market refers to each individual product and occurs only once per product across the Union. For a plant that arrives in subassemblies over two years and is erected at the customer's site, that yields no single answer – it raises the prior question of what the product even is here. The Commission's CRA guidelines adopted in July 2026 leave this question open too: they do not address partial deliveries or successive erection; they merely state that a complex system placed on the market as one product constitutes a product with digital elements (para. 29).

The Commission guide to the Machinery Directive supplies the rule closest to the plant engineering case, in paragraph 76: assemblies of machinery erected at the user's premises by someone other than the user are considered placed on the market when the assembly operations are complete and the assembly is handed over to the user for use. Two qualifications apply. First, this is interpretive guidance to the Machinery Directive, which is not superseded by the Machinery Regulation until 20 January 2027; a guide to the Machinery Regulation does not exist as of July 2026 and is expected at the end of the year at the earliest. Second, and more consequentially, the same guide states in paragraph 38 that a complete industrial plant made up of several production lines is not necessarily an assembly of machinery. Whether several machines form an assembly turns on three conditions: a common function, a functional link that requires a risk assessment for the whole, and common controls. Absent these – as in most plants, which consist of several independently controlled sections – the plant decomposes into several distinct machines and assemblies.

German accident insurer BGHM's CRA FAQ points the same way: where only the machine as a whole is placed on the market, only the whole is assessed. Components that are also supplied separately are each a product in their own right. Subassemblies the customer took over and productively used in 2026 or 2027 therefore have a solid argument for having been made available at that point, bringing them under Article 69(2); subassemblies first supplied in 2028 do not. For such projects the more defensible answer may be several dates per subsystem rather than one date per project.

A late delivery date makes CRA retrofitting expensive

The obvious response to a deadline is a schedule buffer. In plant engineering it does not help: CRA-compliant software has to be settled around a year before delivery (release, testing, field maturity of the firmware versions used), so the internally governing date already sits roughly twelve months ahead of the delivery date. Pulling delivery forward to stay safely inside 11 December 2027 pulls the effective software date forward by the same amount.

The reverse case is the expensive one. If the customer's building runs late, a project costed against the old legal position slides past the cut-off. Retrofitting then fails on three counts:

• Codebase: a plant at this scale means raising a codebase in the order of a million lines to CRA conformity retroactively, without budget, lead time or supplier commitments in place.
• Component base: the plant contains some 90,000 ordered items, standard fasteners excluded, a substantial share of them carrying firmware down to the main disconnect switch. Replacing a single component ties up at least six months of engineering and lab work plus another six months of field testing, because the replacement has to exhibit identical behaviour: speed, safety response, current draw. An internal threshold of around 30 per cent advantage in price, quality or mean time to failure therefore often applies, below which no swap is attempted at all. What is designed in stays in.
• Suppliers: with the component base fixed, the lever sits with suppliers. Commitments there either fail to materialise or are given only for December 2027, too late for an in-house lead time of a year.

CRA conformity therefore belongs in the quotation rather than in the closing project phase, including the question of who carries the retrofit risk when the delay does not originate with the supplier. How suppliers without machine-readable advisories can be monitored at all is covered in the cybersecurity roadmap article.

A grace period is not something to plan around

The AI strand of the Digital Omnibus postponed AI Act deadlines in June 2026; the broader strand, which touches incident-reporting channels and thus the CRA, has not yet been agreed and is expected at the end of 2026 at the earliest. Neither touches the CRA dates, and the Commission's CRA page still states 11 December 2027. What has slipped is standardisation: a shift of roughly two months in the standardisation request deadlines is under way, and on Werkspilot's assessment (not officially confirmed) harmonised standards will scarcely be available in full in time for 11 December 2027. A late standard does not postpone a legal obligation, however; it only raises the cost of demonstrating conformity without a presumption of conformity.

Three questions from practice

Can the date of placing on the market be fixed contractually?

What can be fixed contractually is which event the parties treat as governing and which document evidences it – and doing so is worthwhile, because otherwise nothing at all is available in a dispute. Market surveillance is not bound by such an agreement. The criterion comes from the regulation; only the evidence is at the parties' disposal. The position becomes robust when completion of manufacture can actually be demonstrated at the chosen point.

What applies to spare parts and later shipments?

An exception applies here that is worth knowing. Under Article 2(6) the CRA does not cover spare parts that replace an identical component and are manufactured to the same specifications as the part they replace. A like-for-like drive supplied in 2028 as a spare part for a plant delivered in 2026 is therefore out of scope – not newly placed on the market in 2028. The line thus runs not between new plant and service, but between „identical, to the same specifications" (out of scope) and „something is different": a successor model, a changed firmware version or separately sold add-on software are products in their own right, each with its own date. For firmware-bearing components, though, „identical" is rarely tenable after some years – and that, not the spare part as such, is where the CRA catches the service business.

Does running non-compliant equipment in protected zones help?

As an operator measure yes, as a substitute for the manufacturer duty no. A drive without compliant firmware can be run in a segregated zone, but commissioning and maintenance still require access – so the zone is never fully sealed. When such an intervention amounts to a substantial modification and triggers the duty afresh is covered in the article on the manufacturer role.

The dependable conclusion is unspectacular: fix the date of placing on the market deliberately for each project, document the reasoning, and capture the as-delivered state at acceptance while the plant is still within reach. A network scan at factory acceptance is the last point at which the state actually shipped can be established without reconstruction; what that looks like in practice is described in the article on building SBOMs in plant engineering. Discuss which date holds for your running projects.

Werkspilot monitors supplier advisories automatically and matches them against the installed base of plant builders and integrators. This article reflects Werkspilot's assessment at the time of publication and is not legal advice. The regulatory texts themselves are authoritative.