Practical OT security guidance
Secure remote access to machines, under NIS2, the Cyber Resilience Act, and the Machinery Regulation
For machine builders, factory operators, and system integrators in the Netherlands, Belgium, and Luxembourg. Three different EU rules, three different reasons they apply, explained plainly and cited.
A one-page brief on which EU rules apply to you, with sources and next steps.
About 2 minutes. No email needed.
- 18 OCTOBER 2024●NIS2 in force in Belgium (Law of 26 April 2024)Source: Law of 26 April 2024 (Moniteur belge), Art. 98, checked 19 October 2026
- 10 MAY 2026●NIS2 in force in Luxembourg (Loi du 5 mai 2026)Source: Legilux gazette record, Loi du 5 mai 2026 (Mémorial A225), checked 19 October 2026
- 15 AUGUST 2026●Cyberbeveiligingswet (NIS2) in force in the NetherlandsSource: Staatsblad 2026, 187 and 189 (Art. 35), checked 19 October 2026
- 11 SEPTEMBER 2026○Cyber Resilience Act, Article 14, appliesSource: Regulation (EU) 2024/2847, Art. 71(2), checked 19 October 2026
- 14 JANUARY 2027○Machinery Regulation (EU) 2023/1230 appliesSource: Regulation (EU) 2023/1230, Art. 54, checked 19 October 2026
- 11 DECEMBER 2027○Cyber Resilience Act fully appliesSource: Regulation (EU) 2024/2847, Art. 71(2), checked 19 October 2026
● in force · ○ upcoming · checked against the sources above on 19 October 2026.
Which of these is you?
Machine builder
You design, build, or sell machinery or equipment. Your product has its own rules.
Factory or plant operator
You run production. Your organization and your suppliers' remote access both matter.
System integrator
You install or service equipment for others. You can sit on both sides of these rules.
Three EU rules, three different things
NIS2
Regulates your organization: is your company managing cyber risk, if it's in scope.
Cyber Resilience Act
Regulates your product: is the machine itself built securely before it's placed on the market.
Machinery Regulation
Regulates safety, newly extended to cover cyberattacks that could create a physical hazard.
A machine builder can face all three at once, for the same machine, for different reasons. None of them name or require any specific product category. See how these and IEC 62443 relate.