Cyber Resilience Act: MOONS’ begins its compliance process under Regulation (EU) 2024/2847
The Cyber Resilience Act (Regulation (EU) 2024/2847) introduces new cybersecurity requirements for products with digital elements placed on the European Union market, making cybersecurity an integral part of product compliance and of the entire lifecycle of industrial solutions.
According to the implementation timeline set out in the Regulation, vulnerability and incident reporting obligations apply from 11 September 2026, while the Cyber Resilience Act will become fully applicable from 11 December 2027.
In this context, MOONS’ Industrial Automation Segment has issued an official statement regarding its CRA compliance process, outlining the activities already underway and the commitments planned ahead of the Regulation’s full application.
Below we reproduce the official MOONS’ statement.
Statement on Compliance with the EU Cyber Resilience Act (EU) 2024/2847
To Our Customers and Partners:
The EU Cyber Resilience Act (Regulation (EU) 2024/2847, the “CRA”) has entered into force.
Under its implementation timeline, vulnerability and incident reporting obligations apply from September 11, 2026, with full application required from December 11, 2027.
This means that cybersecurity responsibility for products with digital elements placed on the EU market now extends beyond the factory gate across the entire product lifecycle.
MOONS’ Industrial Automation Segment attaches great importance to the compliance requirements introduced by the CRA and regards them as an important step in enhancing product security and maintaining long-term customer trust.
We are actively addressing this Regulation, have initiated internal compliance work, and will update our EU Declaration of Conformity (DoC) as scheduled.
Work already underway at MOONS’
We have commenced the following work:
- Establishing a cross-functional CRA compliance working group, developing a phased implementation plan, and conducting gap analyses across relevant product lines;
- Building vulnerability management and Product Security Incident Response Team (PSIRT) capabilities, including reporting processes aligned with the ENISA Single Reporting Platform;
- Advancing Software Bill of Materials (SBOM) development and third-party component security management to improve supply chain transparency;
- Preparing technical documentation in line with CRA requirements, covering secure design, risk assessment, testing, and vulnerability management records;
- Integrating cybersecurity requirements into product requirements, design, testing, and maintenance processes based on our established functional safety design and verification practices, with a focus on secure default configurations, access control, and secure update mechanisms;
- Continuously tracking the development of CRA harmonized standards (EN 40000 series) and preparing for conformity assessment in due course.
MOONS’ commitments to customers and partners
MOONS’ hereby commits to:
1. Timely compliance
Completing relevant compliance preparation before the CRA’s full application on December 11, 2027.2. Ongoing support
Providing security updates free of charge and without delay throughout the product support period.3. Transparent communication
Updating customers and partners on compliance progress and providing necessary security information and usage guidance.4. DoC updates
Upon completion of conformity assessment, updating the EU Declaration of Conformity (DoC) as scheduled and incorporating CRA requirements into the existing CE compliance framework.Security vulnerability and incident reporting
If you discover a security vulnerability or security incident related to MOONS’ products, please report it via the following dedicated email address: cra.ama@moons.com.cn
This statement is for informational purposes only and does not constitute legal advice. The compliance status of specific products shall be governed by the respective EU Declaration of Conformity (DoC).
MOONS’ Industrial Automation Segment
Cyber Resilience Act and industrial automation
For the industrial automation and motion control sector, the Cyber Resilience Act further reinforces the importance of cybersecurity throughout the entire lifecycle of products with digital elements.
Areas such as secure design, vulnerability management, software updates, access control, technical documentation and supply chain security are therefore becoming increasingly important in the design, maintenance and support of industrial automation systems.
As a MOONS’ partner, IPC will continue to follow the compliance process and share official updates concerning products intended for the European market.
