CRA for agricultural machinery and farm technology

Why agricultural machinery falls under the Cyber Resilience Act

A modern tractor is a networked system: control units on the vehicle bus, an ISOBUS terminal in the cab, a GNSS receiver for the steering system, a telematics unit with a cellular connection and, behind it, farm management software in the cloud. In the barn, milking robots, sensors for animal and climate data and gateways bring data to the internet. Under Article 2(1), the Cyber Resilience Act (Regulation (EU) 2024/2847, CRA) applies to products with digital elements “the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network”.

The CRA does not define a data connection. As a supplementary aid, one can refer to the draft Commission guidance on the application of the CRA, the content of which the Commission approved on 27 July 2026 (C(2026) 5252, so far in English only; formal adoption is pending). According to the Commission’s accompanying communication, the guidance will only apply from its formal adoption, and even then it is not binding; an authoritative interpretation can only be given by the Court of Justice of the European Union (para 8). In paras 26 to 28 it focuses on the exchange of digital information; it does not regard signals that merely trigger or power a function as a data connection. In our assessment, a control unit that exchanges messages with the terminal over the bus has a data connection, a valve that is only switched probably does not. Check this initial technical assessment for each product.

Does the vehicle exemption cover tractors? An initial assessment against the official text

The official text does not exempt all vehicles across the board. Article 2(2)(c) CRA excludes products with digital elements to which Regulation (EU) 2019/2144 applies. Its scope is set out in Article 2 of Regulation (EU) 2019/2144: it “applies to vehicles of categories M, N and O, as defined in Article 4 of Regulation (EU) 2018/858”, and to systems, components and separate technical units designed and constructed for such vehicles. Under Article 4(1) of Regulation (EU) 2018/858, these are motor vehicles designed and constructed primarily for the carriage of passengers (M) or goods (N), and trailers (O).

Agricultural and forestry vehicles have a regulation of their own. Article 2(1) of Regulation (EU) No 167/2013 names tractors (categories T and C), trailers (category R) and interchangeable towed equipment (category S). Regulation (EU) 2018/858 expressly excludes these vehicles from its own scope in Article 2(2)(a): it does not apply to “agricultural or forestry vehicles, as defined in Regulation (EU) No 167/2013”.

Our initial technical assessment: categories T, C, R and S are not among categories M, N and O referred to in Article 2 of Regulation (EU) 2019/2144. On its wording, the exemption in Article 2(2)(c) CRA therefore does not cover agricultural and forestry vehicles under Regulation (EU) No 167/2013, nor systems and components built exclusively for them. For category L vehicles under Regulation (EU) No 168/2013, Delegated Regulation (EU) 2025/1535 provides a separate exemption, with an exception for certain category L1e vehicles designed to pedal. We have found no delegated act under Article 2(5) CRA in the Official Journal up to 1 November 2026 that exempts vehicles under Regulation (EU) No 167/2013. Section 9.3.1 of the draft guidance C(2026) 5252 (paras 241 to 246) likewise deals only with Regulation (EU) 2019/2144 and Regulation (EU) No 168/2013. This conclusion is not legal advice; we flag it for review by your legal department or counsel.

For components fitted across several vehicle worlds, the starting point is the wording of Article 2 of Regulation (EU) 2019/2144: it covers systems and components “designed and constructed for such vehicles”. In paras 244 and 245, the draft guidance reads this to mean that only components built exclusively for integration into those vehicles are exempt, while generic components are subject to the CRA. If you offer a telematics unit for both trucks and tractors, in our initial assessment this strongly suggests that it falls under the CRA. Our page CRA and automotive describes the boundary for road vehicles, retrofit parts and accessories.

Typical products and their likely classification

Whether a product counts as important (Annex III) or critical (Annex IV) depends on its core functionality (Article 7(1), Article 8(1)). Under the second sentence of Article 7(1), integrating a component with an Annex III core functionality does not in itself subject the overall product to the procedures for important products. The technical descriptions of the categories are set out in Implementing Regulation (EU) 2025/2392. The table is an initial technical assessment, not a binding classification.

For telematics and barn gateways, the core functionality decides: the Implementing Regulation lists cellular modems and routers with or without modems under point 12. A device that collects machine data and transmits it via a built-in modem uses the modem as a component. A gateway that mainly connects sensors and other devices in the barn to the internet may, by contrast, have the core functionality of a router. For farm management software, the cloud part belongs to the product if it meets the definition of remote data processing in Article 3(2). The provision contains three elements: processing at a distance, software designed and developed by the manufacturer or under its responsibility, and without it the product could not perform one of its functions; the draft guidance explains them in section 8. More on this under CRA product classes.

Machinery Regulation: its own cybersecurity requirements from 20 January 2027

The Machinery Regulation (EU) 2023/1230 applies, under Article 54 as corrected (corrigendum, OJ L 169 of 4 July 2023, p. 35), from 20 January 2027. Its Annex III contains two essential requirements related to cybersecurity. Section 1.1.9 (protection against corruption) requires that connecting another device, including via a remote device, does not lead to a hazardous situation, that safety-relevant software and data are adequately protected against accidental or intentional corruption, and that the machinery collects evidence of a legitimate or illegitimate intervention in the software or its configuration. Section 1.2.1 (safety and reliability of control systems) requires in point (a) that control systems, where appropriate to the circumstances and the risks, can also withstand “reasonably foreseeable malicious attempts from third parties leading to a hazardous situation”.

These requirements apply alongside the CRA. Under recital 53 CRA, manufacturers of products that fall under the Machinery Regulation and are also products with digital elements should meet both sets of requirements and follow the conformity assessment procedures of both regulations. The same recital states that compliance with the CRA requirements could facilitate compliance with sections 1.1.9 and 1.2.1; the manufacturer has to demonstrate such synergies. The perspective differs: the Machinery Regulation asks whether an intervention leads to a hazard, while the CRA additionally requires, for example, vulnerability handling over the support period (Annex I Part II) and reporting under Article 14.

For agricultural machinery, Article 2(2)(i) of the Machinery Regulation matters. It excludes agricultural and forestry tractors as well as systems, components, separate technical units, parts and equipment designed and constructed for such tractors that fall within the scope of Regulation (EU) No 167/2013, “except for machinery mounted on those tractors”. The provision names tractors only. Our initial technical assessment: under this provision, the Machinery Regulation does not apply to the tractor itself; implements, towed equipment and barn technology such as milking robots may, by contrast, be covered as machinery or interchangeable equipment (Article 2(1)). We flag this for legal review as well. Machine building in general is covered in our article CRA in machine building.

Long service life, spare parts and interoperability

This matters for long-lived agricultural machines: the manufacturer determines the support period so that it reflects the expected use time; it is at least five years unless the product is expected to be in use for a shorter time (Article 13(8)).

Under Article 2(6), spare parts are excluded if they replace identical components and are manufactured to the same specifications. In our assessment, a replacement control unit with changed protocols, cryptographic mechanisms or access controls may no longer be identical and is then a product in its own right; the draft guidance takes the same view (paras 100 and 101) and also expects the repair purpose to be apparent from the supply (para 97).

For tractors, terminals and implements from different manufacturers to work together, many devices have to comply with interoperability standards. Recital 55 CRA addresses this case: if an essential requirement is not applicable, for example because the manufacturer has to follow widely recognised interoperability standards, it justifies this in the risk assessment. In paras 31 and 32, the draft guidance adds that manufacturers should assess the risks of such constraints and implement compensating measures.

Obligations and deadlines

• Since 11 September 2026: reporting obligation under Article 14 (Article 71(2)). You report actively exploited vulnerabilities and severe incidents via the single reporting platform under Article 16, with an early warning without undue delay and in any event within 24 hours of becoming aware. Under Article 69(3), the obligation also applies to products placed on the market before 11 December 2027. Details: CRA reporting obligation since September 2026.
• From 11 December 2027: all other obligations (Article 71(2)), including the essential requirements of Annex I, the risk assessment (Article 13(2) and (3)), technical documentation and conformity assessment.
• Legacy products: products placed on the market before 11 December 2027 are subject to the requirements only in the event of a later substantial modification (Article 69(2)); the reporting obligation is not affected.

On 1 November 2026, no harmonised standard for the CRA had been published in the Official Journal. Plan your evidence directly against Annex I for now.

A constructed example

The following example is a composite and does not describe any specific company. A medium-sized manufacturer builds field sprayers with its own ISOBUS job computer, a telematics unit and an app with a cloud connection for job data. It records each product's data connections and passes the vehicle question, reasoned via Article 2 of Regulations (EU) 2019/2144 and (EU) No 167/2013, to its legal department. For the job computer, telematics and app, it assumes the default category from a technical standpoint and documents the core functionality. Because the sprayer may qualify as machinery, it combines the risk assessment for the CRA and sections 1.1.9 and 1.2.1 of the Machinery Regulation in one model. It sets up the reporting process for actively exploited vulnerabilities first, because this obligation already applies.

Next steps

1. Record products with a data connection, from the terminal to the app.
2. Document the vehicle question for each product and flag it for review by your legal department.
3. Compare the core functionality of each product with Annexes III and IV and Implementing Regulation (EU) 2025/2392.
4. Set up the reporting process and vulnerability handling, because Article 14 already applies.
5. Bring the requirements from the CRA and the Machinery Regulation together in one risk assessment.

We assess the scope and product class of your agricultural machinery from a technical standpoint and flag the open legal questions for review by your legal department or counsel. A first step is the applicability check; the CRA gap analysis measures the status of each product, and reporting process and PSIRT covers the reporting process. To talk to us: get in touch.