eu.bac
05/11/2026

Cyber Resilience Act: What does it mean for TBS and BACS manufacturers? 

On 8 September 2026, eu.bac and ten partner associations launched the joint industry paper on the Cyber Resilience Act (CRA) for manufacturers of Technical Building Systems (TBS) and Building Automation and Control Systems (BACS).  

After the document’s publication in July 2026, and following the European Commission’s own guidance published in the same month, this launch event was an opportunity to gather industry leaders and Commission officials to discuss the challenges and opportunities that the CRA brings to the building automation sector. 

Key messages from the Commission Representative on CRA implementation   

  • Reporting obligations began on 11 September 2026. 
  • The Commission is aligning Member States, notified and accreditation bodies, and market-surveillance authorities on a consistent approach. 
  • The emphasis is on support, practical guidance and gradual implementation. 
  • Security before paperwork: Security is the objective; documentation must provide credible evidence that the requirements are met. Manufacturers with sound cybersecurity practices should find the CRA demanding but achievable. 

Find out more on Section 9.1. of the Joint Industry Guidance: “Reporting as a regulatory channel, not a public announcement” (p. 25). 

Shared responsibility in multi-vendor ecosystems 

  • Obligations follow each party’s role in placing products on the market, but cybersecurity is a shared effort. 
  • Where interoperability or legacy dependencies constrain a security measure, assess and document the resulting risks, implement justified alternative or compensating measures, and communicate relevant constraints. Find out more on Section 7.1.5 of the Joint Industry Guidance: “Product vs project: risk acceptance criteria in multi-vendor TBS/BMS” (p. 13).   
  • All groups (manufacturers, integrators, installers, operators, owners) need more awareness. The Commission recommends ENISA’s Secure by Design and Default Playbook. 

Standards: the missing piece 

  • The CRA is deliberately horizontal and flexible. Horizontal and product-specific harmonized standards can provide presumption of conformity for the essential requirements they cover, once their references are published in the Official Journal. 
  • PT3 (vulnerability handling) is progressing well, and PT2 will provide the catalogue of security controls. 
  • The Commission will publish accepted standards in the Official Journal as quickly as possible. 
  • Meanwhile, use existing standards such as IEC 62443, though they are not mandatory. 
  • Industry’s ask: legal certainty, practical examples, consistent European interpretation.  

Find out more in section 11 of the Joint Industry Guidance: “Commitments and Call to Action” (p. 31). 

Legacy systems: the biggest practical challenge 

  • Poorly coordinated migration can temporarily increase fragmentation and security risks.  
  • The CRA does not require an identical set of security features for every product. Manufacturers must nevertheless demonstrate compliance with applicable essential requirements, taking account of intended purpose, reasonably foreseeable use and justified risk-treatment measures. Manufacturers should document the product-specific risk assessment, the security measures selected, any relevant constraints or compensating measures, and the rationale supporting those decisions. 
  •  Separate transitional rules apply to products already placed on the market.  
  • Find out more in section 8.6. of the Joint Industry Guidance: “Legacy protocols, compensating measures, and credible migration paths” (pp. 18-19).   
  • Repair vs extension: Identical spare parts manufactured to the same specifications may fall outside the CRA under Article 2(6). For extensions or modifications, assess the obligations for any newly supplied products and whether the work constitutes a substantial modification of an existing product. 
  • Where compatibility is needed, justify it in the risk assessment and consider alternatives such as restricting access to legacy components and giving operators clear instructions. 

Enforcement and next steps 

  • The discussion emphasized proportionate, risk-based enforcement and support for consistent implementation. This does not remove applicable obligations or preclude corrective measures and penalties. 
  • Possible next steps include a delegated act specifying how certification under the European Common Criteria-based cybersecurity certification scheme (EUCC) can support presumption of conformity with the CRA. 
  • The Commission invites manufacturers and associations to submit concrete unclear cases. The aim is to progressively reduce gray areas without replacing risk-based flexibility with rigid rules. 

Download the Joint Industry Guidance on the CRA

© 11.2026, eu.bac - European Building Automation and Controls Association