A 24-Hour Clock for Machine Flaws: Rockwell Builds Its Compliance Case Around Europe's New Cyber Rules

Rockwell Automation has rolled out a package of cybersecurity services aimed squarely at the companies that build machines and production lines, branding the offering SecureOT. Its components include security assessments, advisory work, machine-level transparency and vulnerability identification, alongside exportable compliance reports and round-the-clock monitoring of industrial equipment. The whole set is anchored in the IEC 62443 security standard, and its purpose is to help original equipment manufacturers (OEMs) lock down the connected machinery they ship.

The timing is no accident. Brussels has been tightening the legal screws on networked industrial gear, and the deadlines are now close enough to plan around.

What the service does, before and after the machine ships

Rockwell splits the offering into two phases. Ahead of delivery, the system assembles a detailed cybersecurity dossier covering a full system overview, an inventory of software as well as hardware and firmware, known vulnerabilities and the machine's current risk status.

Once the equipment is with its operator, the focus shifts to watching for newly emerging flaws. The system analyses what they mean across entire machine fleets, tracks the status of required security updates and alerts customers to relevant incidents.

Rockwell, which counted roughly 26,000 employees at the end of fiscal year 2025 and serves customers in more than 100 countries, frames the launch as a response to security gaps already present in the market. Its own "OEM Advantage Playbook" survey found that nearly two in five machine builders are grappling with shifting compliance requirements, while 63% of respondents expect cyber risks to persist for their operations.

The regulatory calendar driving the change

The European Union's Cyber Resilience Act (EU) 2024/2847 entered into force on 10 December 2024, and its operational reporting duties have applied since 11 September 2026. Under those rules, manufacturers must send authorities an early warning about actively exploited vulnerabilities within 24 hours, followed by a detailed report within 72 hours. The regulation's broader core obligations take effect from 11 December 2027.

A second layer comes from the EU Machinery Regulation 2023/1230, adopted in June 2023 and binding from 20 January 2027, which makes cybersecurity a fixed element of machine safety.

Germany has been moving in parallel. At the start of October 2026, the Bundestag passed a comprehensive modernisation of product liability law to implement the European requirements; it largely takes effect on 9 December 2026. Under the new regime, software and artificial intelligence count legally as products, and a breach of cybersecurity requirements — or the absence of necessary security updates — can by itself establish that a product is defective.

Who signs the paperwork

One boundary Rockwell was careful to draw in its announcement: the company is not a notified body. Issuing the official declaration of conformity and affixing the CE mark stay entirely with the machine manufacturers themselves. What the firm provides is the technical groundwork — the data and dossiers operators can use to document their regulatory obligations without gaps.