Rockwell SecureOT for OEMs: EU CRA and Machinery Rules

Rockwell Automation said on 29 October 2026 that it had extended its SecureOT portfolio with cybersecurity capabilities aimed specifically at original equipment manufacturers, and it framed the change around two European rulebooks that take effect inside the next fourteen months: the Cyber Resilience Act (CRA) and the Machinery Regulation (EU) 2023/1230. The company positions the new work as a way for machine builders to identify vulnerabilities, document the cybersecurity state of a machine, and keep that documentation current after the machine leaves the factory.

For a buyer of industrial control parts, the interesting detail is not the product announcement. It is what the announcement implies about paper. The CRA has already carried vulnerability and incident reporting duties since 11 September 2026, the bulk of its obligations apply from 11 December 2027, and the Machinery Regulation becomes mandatory on 20 January 2027. Those dates do not move because a machine was designed as an assembly rather than as a standalone product. A vendor platform can produce the evidence that the deadlines assume exists; it cannot produce the evidence retroactively, and it cannot sign a declaration of conformity.

This article separates three things that press releases routinely blur: what Rockwell stated on 29 October, what the two EU instruments actually require and by when, and where a machine builder still stands alone. It closes with the procurement consequences — including what to ask for when you request a quote on the safety controllers, managed switches and HMIs that end up inside a CE-marked machine.

Key takeaways

• Rockwell Automation announced new SecureOT cybersecurity capabilities for OEMs on 29 October 2026, describing a pre-delivery cybersecurity dossier and post-delivery monitoring of newly disclosed vulnerabilities, deployed-fleet impact, security updates and customer notification duties.
• The Cyber Resilience Act entered into force on 10 December 2024; its reporting obligations have applied since 11 September 2026 and its main obligations apply from 11 December 2027, according to the European Commission policy page on the Act.
• CRA reporting runs on a clock, not a single filing: an early warning within 24 hours of becoming aware, a full notification within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure is available for an actively exploited vulnerability, or within one month of the 72-hour notification for a severe incident.
• Notifications go once, through the CRA Single Reporting Platform, to the CSIRT of the Member State where the manufacturer has its main establishment and, in parallel, to ENISA.
• The Machinery Regulation (EU) 2023/1230 was adopted on 14 June 2023 and applies on a mandatory basis from 20 January 2027; it explicitly integrates cyber-safety provisions for compliance-relevant software, data and safety control systems, plus provisions for machinery with AI-powered safety functions.
• Rockwell Automation is not a notified body. Its tools and services generate evidence for a conformity file; the EU declaration of conformity and CE marking remain the manufacturer's own act, and for some important or critical product categories self-assessment is not available at all.

What did Rockwell actually announce on 29 October?

The announcement is a capability extension inside an existing suite, not a new platform. Reading the Shanghai release of 29 October 2026 together with the OEM page Rockwell publishes for its industrial cybersecurity services, the deliverables fall into two blocks.

Before delivery, Rockwell describes building a cybersecurity dossier for the machine that combines a system summary, a software inventory framed as responsive to CRA expectations, a hardware inventory with firmware versions and component detail, a statement of known vulnerabilities, exposure and the associated risk status, and documentation intended to evidence due diligence and secure-by-design practice.

After delivery, it describes monitoring newly disclosed vulnerabilities and product advisories, assessing the impact across the installed fleet of machines, tracking security updates, and supporting customer notification and the regulatory responsibilities that attach to them. The commercial argument Rockwell makes is that this reduces engineering effort per machine and turns compliance work into a repeatable, scalable process rather than a per-project negotiation.

What the release does not state is at least as useful, because those are exactly the points a customer will have to close by other means.

Where does SecureOT sit in the 2026 timeline?

Treating 29 October as Rockwell's entry into OT security would be a misreading. The suite predates the year, and the OEM angle is the fourth distinct step in eleven months. The sequence matters because it shows a vendor assembling a compliance story from platform, services and managed monitoring in separate moves — and because the dates are checkable.

Two observations follow. First, the OEM step arrives three weeks after the firewall and infrastructure managed services, which is what you would expect: fleet-level monitoring is the delivery mechanism for post-delivery duties, so the vendor needed it in place before selling lifecycle compliance to machine builders. Second, the machine-builder framing is the harder commercial problem. A plant buys security for assets it owns. An OEM buys security for assets it sells, in volumes, with margins, and with a support obligation that outlives the sale.

What does the Cyber Resilience Act require, and by when?

The CRA is a product law, not an operator law. It regulates "products with digital elements" placed on the Union market, and it makes the manufacturer — including a machine builder that integrates software or remote data processing into its product — responsible for cybersecurity across a defined support period. The European Commission's own policy page states the dates plainly: the Act entered into force on 10 December 2024, reporting obligations apply as of 11 September 2026, and the main obligations apply from 11 December 2027. The Commission published practical guidance to support implementation on 27 July 2026.

The reporting mechanics are where most first-time responders fail, because the clock starts at awareness rather than at analysis. Per the Commission's dedicated CRA reporting page and its summary of the legal text, a manufacturer submits an early warning within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident affecting the security of its product, a full notification within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure is available for actively exploited vulnerabilities — or within one month of the 72-hour submission for severe incidents. Reporting happens once, through the CRA Single Reporting Platform maintained by the EU Agency for Cybersecurity, addressed to the CSIRT of the Member State of main establishment and made available to ENISA unless exceptional circumstances apply. The receiving CSIRT then disseminates to the other CSIRTs on whose territory the product has been made available.

Now translate that into machine-building reality. A 24-hour clock requires that someone already knows which of your machines contain the affected component, at which firmware revision, sold to which end customers in which Member States. That is an asset-and-provenance question, not a security-operations question. It is also, structurally, the same question as a spare-parts question — which is why the two inventories should be one record.

How does the Machinery Regulation change the same picture?

The Machinery Regulation (EU) 2023/1230 was adopted on 14 June 2023 and, per the Commission's machinery sector page, applies on a mandatory basis as of 20 January 2027. Until then, machinery placed on the market is still governed by the 2006/42/EC Directive, with a voluntary option to declare conformity against both. The Commission page also notes that a corrigendum was issued to address a clerical error in the application dates of the original version — a small point that matters when you are quoting a legal date to a customer.

The provisions relevant to this announcement are the ones that pull cyber into safety. The Commission's summary lists that the Regulation integrates provisions for machinery with AI-powered safety functions, and integrates provisions for cyber-safety covering compliance-relevant software, data and safety control systems. It addresses conformity assessment for machinery presenting a higher risk factor, updates product-category-specific provisions, and clarifies when instructions for use and the declaration of conformity may be supplied in digital form.

Why does one machine face two rulebooks?

Because the two laws ask different questions about the same object, and neither defers to the other on the overlap. A packaging line is an assembly under machinery law. Its safety controller, its HMI and its managed switch are products with digital elements under CRA when they are placed on the market, and the software the machine builder writes into that line is the part that most often makes the builder itself a manufacturer of a product with digital elements.

Three consequences are worth stating explicitly, because they are where OEM programmes go wrong.

Satisfying one does not satisfy the other. A safety function validated to a Performance Level under machinery rules can still sit on a controller whose firmware is unsupported, which is a CRA problem. Conversely, a well-patched controller does not by itself demonstrate that the machine's safety-related software is protected against corruption that would defeat a guard interlock.

The person who signs is the person who integrated. A machine builder that selects components, writes application software and places the assembled machine on the EU market cannot delegate the declaration to its component suppliers. It can, and should, inherit their evidence — firmware release notes, security advisory feeds, support-period end dates — but inheritance is not substitution. This is also the point at which vendor-neutral tooling earns its keep: an OEM selling lines built from several automation brands needs one record across them, not one portal per brand.

There is a date cliff on long projects. A line ordered against the old directive in 2026 and handed over after 20 January 2027 sits in an awkward position, and a machine placed on the market before 11 December 2027 will still be in service after that date, with support-period duties attached. Buyers should expect the documentation package to change mid-project and should write the contract so that the version of the evidence delivered matches the date of placing on the market, not the date of the purchase order.

What do the 40% and 63% figures show — and what do they not?

The 29 October release cites two numbers: nearly two-fifths of OEMs are already dealing with changing compliance requirements, and 63% expect cybersecurity risk to persist. Both come from Rockwell's own OEM research programme — the OEM Advantage Playbook, published in March 2026 — which the company describes as surveying 500 OEM leaders across 17 countries.

Treat that as a vendor-hosted survey, which is what it is. It is a legitimate market signal and a legitimate sales asset. It is not an independent measurement, the sample is defined by the vendor, the question wording is not reproduced in the release, and there is no third-party audit attached. It is also not the only Rockwell number in circulation: the company's separate State of Smart Manufacturing programme, whose 2026 editions were published through the autumn, reports a broader population of industrial decision-makers and a different headline — cybersecurity among the leading external risks to growth. Quoting one series inside the other's sentence is the most common way these figures get corrupted in secondary coverage.

The defensible reading is narrower than the release implies: a substantial minority of machine builders already treat CRA and Machinery Regulation readiness as an active workstream, and a majority expect cyber risk to remain a standing concern. That is a statement about where the industry is in late 2026. It is not evidence that any particular OEM is compliant, and it is not a reason to defer your own assessment.

Can a vendor platform substitute for compliance?

No, and it is worth being precise about why, because "compliance-ready" is now a marketing term with three different meanings in automation catalogues.

A notified body under the CRA is a conformity assessment body designated under Article 43 by a Member State. Rockwell Automation is not one, and neither is any other automation OEM; a designation would be published in the EU's NANDO database, and no vendor tool appears there for this purpose. What a platform can do is make the artefacts that a conformity file needs: inventories, version records, vulnerability states, exposure, update history, notification drafts. What it cannot do is perform the conformity assessment, issue the EU declaration of conformity, or affix CE marking. Those are legal acts by the manufacturer, and for products whose core functionality falls in an important or critical category under Annexes III and IV, the manufacturer may not even be allowed to self-assess.

There is a second, quieter limit. Coverage is only as good as the fleet record underneath it. A platform that monitors the machines it can see will report confidently about those machines and say nothing about the ones it cannot — the line built in 2019 with a discontinued controller, the retrofitted safety relay, the third-party vision system on the same switch. If you are buying a compliance capability, ask what the asset inventory excludes before you ask what it includes.

What should machine builders and buyers do before 2027?

Six concrete moves, in the order most programmes can actually execute them.

1. Make firmware part of the specification, not the shipment. Every machine should leave with a component-level record of model, order number and firmware revision. That is the row your vulnerability monitoring joins on, and it is the same row a spares buyer needs. Controllers designed to IEC 62443-4-2 with explicit security features make this easier to document; the Allen-Bradley 1756-L72S GuardLogix 5570 processor, the 1756-L83ES GuardLogix 5580 safety controller and the 1769-L33ERM Compact GuardLogix 5370 L3 controller are the class of parts where version traceability pays twice — once for compliance, once for support.

2. Get a view of what is actually on the network. You cannot report a 24-hour early warning about a machine you cannot enumerate. Managed switches give you port-level attachment data; a tap gives you the traffic without becoming a failure point in the control loop. See the Allen-Bradley 1783-BMS20CGN Stratix 5700 managed Ethernet switch, the 1783-ETAP2F Stratix 5700 Ethernet tap and, for retrofits where management is not wanted, the 1783-US8T Stratix 2000 unmanaged switch and the 1783-US6T2F. If you are specifying across brands, the Siemens 6GK5602-0BA10-2AA3 SCALANCE S602 firewall module is the usual comparison point, and the honest answer is that mixed estates are normal.

3. Put safety I/O into the same record as the controller. The most common gap in a machine dossier is the field layer: safety inputs and outputs that were commissioned once and never inventoried. 1734-IB8SK POINT Guard I/O digital safety input module, the 1768-L45S Compact GuardLogix safety controller and the 1768-L43S Compact GuardLogix controller are exactly the parts that end up undocumented because they are "small". For a cross-brand example of a safety input card that needs the same treatment, see the ABB DI581-S SIL2/SIL3 safety digital input module.

4. Document the operator interface, and its lifecycle. HMIs are products with digital elements, they run software stacks with dependencies, and they are frequently the longest-lived part of a machine. The Allen-Bradley 2711P-B10C10D2 PanelView Plus 1000 is a good example of a panel family where buyers should confirm current lifecycle status before specifying it into a machine with a ten-year service expectation. For the control-layer comparison, our own breakdown of the CompactLogix 5390 launch and its IEC 62443-4-2 positioning covers what "secure by design" means at component level.

5. Ask for the support period in the quote, not in the contract. The CRA requires the manufacturer to determine a support period and to supply its end date with the product. Make that a line item in every RFQ for controllers, drives, safety relays and panels, together with the security-update policy and the advisory feed you will be notified through. Where you cannot get it, treat the part as a documented risk in the machine dossier — that is a defensible position; silence is not.

6. Plan spares against the dates, not against the datasheet. A machine that must be supported through a declared period needs parts available through that period. The same logic applies to the 1756-EN2TR EtherNet/IP bridge module, the 1769-L36ERM CompactLogix controller and the 1606-XLS480E 480 W power supply as to the controller itself. Our pieces on CISA's 2030 OT security posture and legacy PLC spares, on the PHP2Shell incident in industrial web interfaces, and on the 29 October CISA ICS advisory wave all describe the same failure mode from different directions: the exposed asset is usually the one nobody was tracking.

For the wider estate view, the browse routes below are where the relevant stock sits: Allen-Bradley, Siemens, ABB and Bently Nevada brand archives, plus the communication modules, HMI and operator panels, safety and protection, network adapters, Ethernet switches, PLC and I/O modules and I/O modules categories. On the software and services side, see how we read Rockwell's FactoryTalk Conductor announcement and the HCLSoftware acquisition of Robotiq.ai — both are about who owns the lifecycle of the code in your machine, which is the same question the CRA asks with a deadline attached.

One caution on tone. Nothing here is legal advice, and no article substitutes for the regulation text and the Commission's implementation guidance of 27 July 2026. Where a conformity question is genuinely open — whether your line is an "important product" under Annex III, whether you are a manufacturer or a supplier of a component — that is a question for your notified body or your regulatory counsel, and the answer belongs in your technical file.

Frequently asked questions

What is Rockwell SecureOT?

SecureOT is the name of the Rockwell Automation industrial cybersecurity portfolio. It combines a SecureOT platform for asset visibility, risk prioritisation and vulnerability management, professional services for assessment and implementation, and managed security services delivered from Rockwell OT security and network operations centres. The suite was announced on 12 November 2025 and is described by the vendor as vendor-neutral and aligned to NIST CSF, NIS2 and IEC 62443. The 29 October 2026 item adds capabilities aimed at OEMs.

Does the Cyber Resilience Act apply to industrial machines?

It applies to products with digital elements placed on the EU market, which includes controllers, drives, panels, safety components and the software in them, and it can apply to a machine builder directly when that builder develops or markets software, including remote data processing solutions. Whether a specific assembly is itself in scope, or whether the obligation sits with the component supplier, depends on how the product is placed on the market and under whose name.

When do CRA reporting obligations start?

They apply from 11 September 2026, ahead of the main obligations that apply from 11 December 2027. The manufacturer submits an early warning within 24 hours of becoming aware, a full notification within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure is available for an actively exploited vulnerability, or within one month of the 72-hour notification for a severe incident.

What is the difference between the CRA and the Machinery Regulation?

The CRA is a cybersecurity product law: it sets essential cybersecurity requirements, vulnerability handling duties and a reporting clock for products with digital elements. The Machinery Regulation (EU) 2023/1230 is a machinery safety law that now also covers cyber-safety for compliance-relevant software, data and safety control systems, and machinery with AI-powered safety functions. A machine can be subject to both, with separate conformity routes and a single CE marking outcome.

Is Rockwell Automation a notified body for CRA conformity assessment?

No. A notified body is a conformity assessment body designated by an EU Member State under Article 43 of the CRA and listed in the EU notification database. Rockwell provides assessment, tooling and monitoring services that generate evidence. The EU declaration of conformity and CE marking remain acts of the manufacturer, and self-assessment is not always available where the core functionality falls in an important or critical product category.

What should a buyer ask for in a quote request before 2027?

Ask for the model, order number and firmware revision of every electronic component, the declared support period and its end date, the security update policy and advisory channel, and the lifecycle status of the part. Ask the same for the machine as a whole: a component-level list, a software inventory, and a named contact for vulnerability notification. Put the answers in the technical file rather than in email.

Sources

The regulatory dates and reporting windows in this article were read on 30 October 2026 from European Commission pages, all of which returned HTTP 200 from our server: the Cyber Resilience Act policy page (digital-strategy.ec.europa.eu, last updated 7 September 2026), the CRA reporting obligations page (digital-strategy.ec.europa.eu/en/policies/cra-reporting), the CRA summary of the legal text (digital-strategy.ec.europa.eu/en/policies/cra-summary), and the machinery sector page covering Regulation (EU) 2023/1230 (single-market-economy.ec.europa.eu/sectors/mechanical-engineering). The EUR-Lex full-text pages returned an anti-bot response to our automated fetch, so article-level citations above are limited to what the Commission's own summaries state.

Vendor material: Rockwell Automation's press release of 29 October 2026 (Shanghai) on new SecureOT capabilities for OEMs, as distributed by Chinese newswire partners and reachable in full text; the SecureOT solution suite release dated 12 November 2025 (Milwaukee), also republished for the China market on 19 January 2026; the SecureOT portfolio expansion release dated 9 June 2026; and Rockwell's OEM cybersecurity services page, which lists the pre-delivery dossier and post-delivery monitoring items quoted here. Rockwell's own domain returned HTTP 403 to our automated requests, so those capability descriptions are attributed to the vendor and were not independently verified. The 8 October 2026 report on Firewall Managed Services with Fortinet and Infrastructure Managed Services is from Industrial Cyber (industrialcyber.co), which returned HTTP 200. The 500-respondent, 17-country methodology for the OEM Advantage Playbook is Rockwell's own statement, repeated in its event catalogue and distributor materials; we did not see a public methodology document.

Talk to us

We stock and supply Allen-Bradley, Siemens, ABB, Bently Nevada and other automation hardware, and we quote by model and firmware revision. If you are assembling a compliance file for a machine line, or you need a support-period and lifecycle answer on a specific part number, send the list through our contact page and we will respond with availability, lead time and whatever lifecycle status we can confirm.