Industry associations launch guidance paper on the Cyber Resilience Act for building automation manufacturers
eu.bac and partner associations publish a practical industry paper to support Technical Building Systems and Building Automation and Control Systems manufacturers in preparing for the EU Cyber Resilience Act.
eu.bac, together with a broad group of European industry associations, has contributed to the publication of a new industry paper: “Obligations and Opportunities for Technical Building Systems and Building Automation and Control Systems Manufacturers under the Cyber Resilience Act.”
The paper is addressed primarily to manufacturers of Technical Building Systems (TBS), including Building Automation and Control Systems (BACS), from SMEs to large enterprises. It provides practical and non-binding guidance on how the EU Cyber Resilience Act (CRA) applies to products with digital elements in the building sector.
The paper highlights that cybersecurity is no longer only a product feature. Under the CRA, it becomes part of the product lifecycle: from design and development to secure configuration, vulnerability handling, security updates, customer information and long-term support strategies.
For manufacturers, this creates both obligations and opportunities. The paper identifies several areas where the CRA can help strengthen the market, including better product quality, more transparent lifecycle and service models, stronger interoperability, modernisation of legacy practices, and a more structured cybersecurity dialogue across the supply chain.
For eu.bac, the paper reflects a wider industry commitment to making cybersecurity a practical and embedded part of product quality in building automation and controls. The transition will require collaboration between manufacturers, system integrators, building owners, operators, authorities and standards bodies. It will also require realistic standardisation that reflects the specific conditions of technical building systems.
Disclaimer
The paper is intended to support a common understanding within the sector. It does not constitute legal advice and does not replace the CRA legal text or formal guidance. Each manufacturer remains responsible for its own compliance decisions and evidence, and a case-by-case assessment will always be necessary.