The EU Cyber Resilience Act is raising the bar for every connected device used in industry. Sensor specialist Leuze is responding with threat analysis from the earliest design stage, hardened sensor architectures, authenticated access and security updates for the full planned service life of its products.
A regulation that arrives in stages
Adopted in 2024, the Cyber Resilience Act (Regulation (EU) 2024/2847) applies step by step:
- 11 September 2026 – manufacturers of products with digital elements must report actively exploited vulnerabilities and serious security incidents through a central EU reporting platform.
- January 2027 – the new Machinery Regulation (EU) 2023/1230 enters into force, with its own requirements on cybersecurity and digital safety components.
- December 2027 – every new digital product placed on the EU market must comply with the CRA.
In practice, manufacturers have to evaluate and document cyber risks, run a secure development life cycle and launch only products protected against attacks according to the current state of the art.
Why connected automation needs this now
Factories rarely replace equipment overnight. Older machines often share the network with modern, highly connected devices, and because controllers and machinery stay in service for many years, a weakness can remain exploitable for a long time. More connectivity also means a bigger attack surface: a small gap can be enough to stop a line or expose sensitive production data.
The CRA tackles this by making security a requirement during development, operation and the whole product lifecycle of devices with digital components, which includes many Leuze sensors. A key point is that products must be technically able to receive security updates, and manufacturers must deliver them when needed. For users, that means devices that are designed, run and maintained to current security standards.
Leuze’s three pillars for CRA-ready sensors
Leuze started adapting its development and production processes to the CRA early. Its long experience in functional safety, protecting people at the machine, made the step into security, protecting systems and networks against attacks, a natural one: both disciplines rely on similar methods and processes. The approach rests on three pillars:
- Security by design – sensors are developed to the current cybersecurity state of the art. Their architecture now includes secure boot and a protected file system: at start-up, hardware security functions check that the loaded software is genuine. Data stored on the sensor is protected against manipulation, and communication channels support encrypted data transfer.
- Security by default – sensors leave the factory in a secure configuration, with all optional interfaces switched off and authentication required for every access. They can be reset to factory settings at any time, deleting customer-specific data.
- Updatability – sensors in the field can be brought up to the latest security level, where suitable via the process interface. If an update fails, the device falls back to its last secure state.
Security at every step of sensor development
At Leuze, security is now part of every phase of new sensor development:
- Threat analysis – a risk matrix identifies and rates possible attack scenarios.
- Smaller attack surface – strict security requirements are set from the very first product specification.
- Long-term security updates – defined lifecycles set how long each sensor is supported and how successor products are introduced. Customers receive regular updates throughout the planned service life to keep devices working and close known vulnerabilities. Leuze is also developing ways to update all its devices in a system at once.
- Documentation – each product comes with detailed documentation for safe and secure use.
- Vulnerability handling and reporting – established processes detect and manage weaknesses and make sure incidents are reported within the CRA deadlines.
Helping customers through the transition
Until the CRA is fully in force, Leuze positions itself as a partner for secure sensor solutions. The company explains the new obligations, shares proven practices and answers customer questions, from choosing the right devices to integrating them securely into existing plants. Its support covers:
- Individual advice – specialists help customers assess their systems and components.
- Application guidance – concrete recommendations for operating sensors and controls securely.
- Documentation assistance – help preparing the required technical documentation.
- Incident reporting know-how – how to report security incidents and what to do in an emergency.
With this approach, Leuze aims to make CRA compliance a built-in feature of its sensors rather than an extra burden for machine builders and plant operators. For more on industrial cybersecurity and new automation products, browse our latest automation news.