What each regime attaches to an automated asset, and who it binds
Five regimes, ticked on the register, and the Cyber Resilience Act named on every connected asset as what to ask the supplier. Each page says which assets the regime reaches, the rows it attaches, who each row binds and what the register exports for it.
IEC 62443 38 clauses; binds Part 2-1 binds the asset ownerNIST SP 800-82 Rev 3 15 clauses; binds guidance addressed to the operator of the OT environment: it binds nobody in law and is what most OT security programmes are assessed against.the EU AI Act 8 clauses; binds Articles 26 and 4 bind the deployerthe EU Machinery Regulation 9 clauses; binds the manufacturer of the machineISO/IEC 27001:2022 10 clauses; binds the organisation that holds the certificatethe EU Cyber Resilience Act informational; binds manufacturers, importers and distributors of products with digital elements; never the owner using them.
Named references the register links and never quotes: EU AI Act Annex I, the Union harmonisation legislation whose products carry high-risk classification (the Machinery Regulation is listed in it); IEC 62443-3-2, the zoning and risk assessment method the zone and conduit sheet follows; ISO 10218, ISO/TS 15066, ISO 3691-4, ISO 13849-1, IEC 62061, IEC 61508, IEC 61511, ISO 12100, EN 415 and ISO 21384: the safety standards named per class, not held in the corpus and never quoted.