Connected Products DACH 2027

In machinery and equipment, it is no longer only the factory that is connected but also the product that leaves it. The large majority of surveyed German makers of products with digital elements (94 %) already sell devices that can be updated in the field. Each of these devices extends the manufacturer’s responsibility beyond the factory gate and is a potential point of attack. The European Commission puts the damage its Cyber Resilience Act (CRA) could spare EU businesses at €180-290 billion a year.

Europe has answered with five acts: the CRA, the Data Act, the Machinery Regulation, the cybersecurity rules of the Radio Equipment Directive and the Batteries Regulation. Between August 2025 and December 2027 they make security, updates and data access a condition of market access. The first duty already applies. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities within 24 hours through ENISA’s single reporting platform.

The hardware of products launching in 2027 has to be fixed now. Yet no harmonised standard under the CRA or the Machinery Regulation is in the Official Journal, and no notified body has yet been designated under the CRA. Reliable cost figures are scarce, and few of the surveyed makers are ready. Whether security belongs in the product is no longer the manufacturer’s decision but the law’s.

Deadline

24 hours

to the early warning on an actively exploited vulnerability

Readiness

3 %

of surveyed makers consider themselves fully CRA-compliant

Standards

0 of 41

requested CRA standards cited in the Official Journal

Cost

< €0.50

security premium per device and month at 10,000 units

This report examines which design secures a connected product most cheaply over its life. It answers the question for manufacturers with 100 to 4,999 staff in Germany, Austria and Switzerland, using four typical devices: a battery tool, a machine with a gateway, a controllable building device such as a heat pump, and a logistics tracker. For these devices our cost model prices the base cost of radio and cloud and the security premium at list prices, in the base case for 10,000 units per product over five years. The security premium is small per device and about the same for every product. Unit volume, radio and backend decide the bill, and these choices are made before the standards arrive.