Questions machine builders ask.
Machinery Regulation, Cyber Resilience Act, data retention and the limits of the tool: short answers, no promises.
Does Ormatrace make my machine compliant with the Machinery Regulation?
No. Ormatrace collects and keeps the technical evidence required by sections 1.1.9 and 1.2.1(f) of Annex III. Conformity of the machine remains the manufacturer's responsibility and part of its risk assessment, possibly with the support of a CE consultant.
Does Regulation 2023/1230 also apply to machines already sold?
No, it is not retroactive. It applies to machinery placed on the market from 20 January 2027. Machines already delivered remain under the directive they were marked to, unless substantially modified.
How long must intervention data be kept?
Section 1.2.1(f) requires intervention data and uploaded safety software versions to be kept for five years. Ormatrace keeps interventions, version history, related telemetry windows and the signed log roots for five years.
Do I have to change the router or remote-service system I already use?
No. Ormatrace works alongside your existing service VPN or router. If the router cannot host the agent, a small DIN-rail Edge unit is added next to it.
Does it work with Box4AI's ConnectBox OEM?
Yes. Ormatrace is part of the Box4AI platform for machine builders: on ConnectBox OEM gateways the agent is already prepared, and VPN remote-service sessions are attributed to technicians with no extra configuration. With VBox4AI sensors, the before/after comparison also uses vibration data.
Can Ormatrace control the machine or block traffic?
No. The agent observes and records: it never writes to PLCs or drives and never blocks communication. This limit is deliberate and part of the design.
Does Ormatrace monitor the customer's plant network?
No. It works only on the machine and its service connection, never on the plant's IT network.
How do I know the data has not been altered?
Each message contains the hash of the previous one, and every day the log root is signed with an Ed25519 key. The signed root can be sent to the machine builder: recomputing the chain with an independent script shows that no entry has been deleted, added or changed.
What is cyber-physical correlation?
After every intervention Ormatrace compares the machine's physical behaviour (vibration, temperatures, cycle times, currents) before and after. So the evidence says not only that something changed, but also whether the machine was affected.
How does it relate to the Cyber Resilience Act?
The CRA (Regulation (EU) 2024/2847) covers products with digital elements, including many machine components. Ormatrace collects device SBOMs in CycloneDX format and checks them daily against known vulnerabilities, which helps with vulnerability handling obligations.
Where is the data stored?
On servers in the European Union. Interventions are attributed to technician IDs; the link between ID and person stays with the machine builder, in line with the GDPR.
How much does it cost?
A machine model assessment starts from €3,000 and the subscription from €15 per machine per month, excluding VAT. Any Edge hardware is quoted separately.
Can't find your question? Write to us, we reply within two working days.