Cyber Resilience Act
Security as an integral part of our sensors
The increasing level of connectivity in industrial automation is opening up new opportunities for efficiency and transparency – yet at the same time, demands on cybersecurity are also rising. For Leuze, security is therefore not merely a downstream issue, but a central component of product quality and corporate responsibility. Our aim is to develop sensor solutions that not only are high-performing and reliable, but also meet current and future security requirements.
We take a holistic approach to this: from development and production right through to the operation of our products at the customer’s premises. We are constantly working to further develop our internal processes, methods and structures to identify potential risks at an early stage and address them systematically. At the same time, we monitor technological developments and regulatory requirements very closely so that we can take the right measures at an early stage.
In this way, we lay the foundations to ensure that you can rely on one thing:
secure, future-proof sensor solutions for your applications.
Cyber Resilience Act (CRA) overview:
- EU Regulation 2024/2847 for digital product cybersecurity
- Uniform standards and greater transparency
- Security throughout the entire product lifecycle
- Mandatory risk assessments and updates
- Reporting obligations from September 2026 for serious security incidents and actively exploited vulnerabilities
- Full implementation by December 2027
How we prepare our sensors to meet these requirements:
To ensure your operations are as secure as possible, we analyze our entire range of sensors. In doing so, we identify which products are affected by the EU regulations and assess any potential risks even before delivery. This includes threat analyses, risk assessments and defining appropriate protective measures. Our aim is to ensure that our sensors not only impress in terms of their functionality, but also meet the required security standards – particularly in sensitive and industrial environments.
1. Security is built in from the development stage
Before a sensor is manufactured, we ensure that security considerations are firmly embedded in the development process and assessed. This includes clear security requirements, well-documented software components (SBOM), automated checks, code reviews and comprehensive security tests such as penetration tests and static code analysis. By following this approach, we prevent vulnerabilities from arising in the first place and sustainably improve product quality.
2. Security features integrated directly into the product
Our newly developed sensors will be fitted with multiple protective mechanisms upon delivery. These include secure default settings with only the necessary access rights and permissions (“Security by Default”), a secure boot process in which only software signed by Leuze may be loaded (“Secure Boot”), and secure updates that are transmitted in encrypted form and verified. If an update fails, a rollback mechanism ensures operational security. These measures significantly reduce the attack surface and reliably protect your systems during operation.
3. Secure processes in production and during commissioning
We will also prioritize security in the production process: Software artefacts are stored with digital signatures, access is strictly regulated and all verification steps are documented. During commissioning, we check for updates, set up secure networks and ensure that configurations are loaded and archived correctly. In future, we will provide you with a digital product passport containing important information such as manuals and certificates.
4. How we deal with vulnerabilities – transparently and quickly
If a vulnerability is discovered at a later date, we respond immediately: We assess the risk, document it, provide solutions or updates, and actively inform affected customers. At the same time, we continuously monitor international public databases for security vulnerabilities so that new risks can be detected at an early stage. In this way, we ensure maximum transparency and remain a reliable partner at your side, even after your purchase.
Cybersecurity for your systems: Frequently asked questions about the CRA
The Cyber Resilience Act (CRA) is an EU regulation on the cybersecurity of products containing digital elements.
Example: A manufacturer of conveyor systems must ensure that the control software is protected against hackers so that production is not brought to a halt.
Essentially, this applies to all products containing digital elements that exchange data or communicate with other products or a network – regardless of the industry or field of application.
Example: Both a sensor on a production line and a smart maintenance device fall within the scope of the regulations.
The CRA will take full effect on December 11, 2027. Initial obligations regarding the reporting of actively exploited vulnerabilities and serious security incidents will take effect as early as September 11, 2026.
Example: A machine builder should conduct security assessments as early as the development phase to avoid having to make adjustments later on.
Yes – cybersecurity is systematically integrated throughout the entire development process.
Example: Potential threats and risks to the control software are assessed right from the design phase of a conveyor system, and appropriate protective measures are implemented.
Manufacturers must identify security risks, safeguard their products, provide security updates, and demonstrate compliance with regulations.
Example: A manufacturer of packaging machines documents all security measures and provides regular software updates.
Customers receive more secure products that are less vulnerable to attacks. This reduces production downtime, protects sensitive data, and ensures long-term reliability.
Example: A food producer can keep its production line running without interruption, even as cyberattacks on corporate systems increase.
Yes – the CRA requires evidence of conformity that demonstrates security and compliance. Leuze confirms compliance with the CRA requirements in the respective product-specific EU Declaration of Conformity (CE Declaration).
Example: A manufacturer of robotic systems can provide its customers with official documentation proving that all safety standards have been met.
Products newly placed on the market must meet the requirements.
Products that are in use or in the customer’s inventory prior to the CRA’s entry into force do not need to be retroactively modified. The same applies to replacement parts that do not involve any technical changes.
Example: Existing systems can be made CRA-compliant through updates and additional security checks without halting production.
Leuze supports customers in the practical implementation of CRA requirements – so you can achieve compliance on time without compromising production.
