Explained

• The Machinery Regulation, (EU) 2023/1230, protects people. From 20 January 2027 a machine must stay safe even when someone tries to tamper with it. Two requirements carry this: protection against corruption (Annex III, 1.1.9) and safe, reliable control systems, including against malicious attempts (Annex III, 1.2.1).
• The Cyber Resilience Act, (EU) 2024/2847, protects the product, its data and the networks it talks to. It covers products with digital elements: anything with software that connects to something. Reporting of actively exploited vulnerabilities and severe incidents applies from 11 September 2026, everything else from 11 December 2027.
• ISO 24882 is a standard, not a law. It describes a method: assess the risk in eight steps, then work through 25 technical topics such as secure updates or protected settings. It is written for agricultural machinery, tractors and earth-moving machinery.

Example: a connected field sprayer must not unfold its boom because of a fake command. That is the Machinery Regulation. Its app and cloud service need security updates, and its maker must report exploited weaknesses. That is the CRA. ISO 24882 shows one way to do both, step by step.

Example: a tractor maker and a sprayer maker sit at the same table. The tractor maker follows the tractor rules, the sprayer maker the Machinery Regulation. The ISOBUS cable between them is a way in that both must think about, but each answers only for its own product.

What it covers. The machine itself, its control units, its connection to the tractor (for example ISOBUS), its radios, apps and cloud services. It asks for two things. First, a risk assessment in eight steps: define the system, list what must be protected, find the threats, rate the harm, rate how likely it is, decide the risk, decide what to do, and turn that into requirements. Second, 25 technical topics, from secure software updates and protected settings to logging and the end of the machine's life. For each topic you decide whether it applies and show how you handle it.

What it does not replace. Functional safety (ISO 25119) and ISOBUS (ISO 11783) stay as they are. Safety asks “what if it fails?”. Cybersecurity asks “what if someone makes it fail on purpose?”.

How to handle it, step by step

1. Buy your copy from ISO or your national standards body. Nobody can apply a standard they have not read.
2. Decide your role: tractor maker, machine or implement maker, or supplier of a part. Each applies the standard to its own product and its own side of every connection.
3. Write the decision down in the technical file: which edition you used, that you used it as a technical method, and why.
4. Reuse your Machinery Regulation risk assessment. If you assessed malicious attempts for 1.1.9 and 1.2.1, most of the eight steps are already there. Add what is missing, usually threats through apps and cloud services.
5. Go through the 25 topics. For each one: does it apply, and why; which protection; which test proves it. A topic without a test is not done.
6. Keep open points visible. Every gap gets an owner and a date. A file that shows its gaps is more convincing than one that hides them.
7. Re-check at publication. When the final edition is out and listed, compare, close the differences and update the file.

Example: Brannvik makes a tractor-mounted sprayer. It applies ISO 24882 to the sprayer, its gateway, app and cloud service, not to the tractor. Its Machinery Regulation file already covered most topics; the rest are listed with owners and dates.

Partly completed machinery is something that cannot do its job on its own and is meant to be built into a machine, such as a boom with its own control unit or a hydraulic module with software. The company that finishes the machine is the manufacturer of the whole machine, but you keep duties of your own (Art. 11):

1. Meet the Annex III requirements that apply to your part. With software or a connection, 1.1.9 and 1.2.1 usually apply.
2. Write the technical documentation of Annex IV, Part B.
3. Sign an EU declaration of incorporation (Art. 22) stating which requirements you met.
4. Supply assembly instructions (Annex XI). For cybersecurity, these are the most important pages you write.

In the assembly instructions, write: which ways in your part has (connectors, buses, radios, service ports); which protections you built in (signed software, locked settings, logs); and what you expect from the machine builder, for example “connect this port only to the machine's internal network”. These expectations are assumptions, and the machine builder takes them into its own risk assessment. ISO 24882 helps here: run its risk assessment on your part only, and where you cannot see the whole machine, write an assumption instead of a guess.

Watch out: partly completed machinery does not carry the CE marking under the Machinery Regulation. With digital elements it may still need one under the CRA.

Example: you sell a boom control unit to a sprayer maker. You sign its software and lock its settings. The assembly instructions say: “the unit trusts commands from the machine's internal network; keep the telematics gateway in front of it.”

• Where it stands: in November 2026 ISO 24882 is at the final draft stage, and its European version is being prepared under the Machinery Regulation. The final text can still change.
• What “harmonised” means: once the European version is published and its reference is listed in the Official Journal of the EU, following it gives a presumption of conformity for the requirements it covers (Art. 20). Until then it gives none. Today the only presumption for 1.1.9 and 1.2.1 comes from a certificate or statement under a cybersecurity certification scheme of Regulation (EU) 2019/881, as far as it covers them (Art. 20(9)).
• What to do now: use it as a recognised technical method, say so in the technical file, and show requirement by requirement how your evidence meets 1.1.9 and 1.2.1. Record the edition.
• What to do later: when the final edition is listed, compare, close the differences and update the file. Plan this as a task with an owner and a date.

Example: Brannvik's file says: “We applied ISO 24882 (final draft) as a technical specification and will re-map to the published edition within six months of publication.”

If you already have a risk assessment, a list of interfaces, protection requirements and test results for the Machinery Regulation, most of ISO 24882 is already covered. In the worked example, 14 of 25 technical topics are fully verified by existing evidence; the rest have named owners and dates. The Bridge Pack shows this topic by topic, and keeps tests that are still planned apart from tests that have passed.