Safety and Cybersecurity Under Emerging EU Legislation for Industry: A Use-Case Driven Perspective

In the era of Industry 4.0, the European Union’s evolving regulatory landscape—comprising the European Cyber Resilience Act (EU CRA), the NIS2 Directives, and the European Artificial Intelligence Act (EU AI Act)—requires organizations to align technical, organizational, and risk governance practices across complex operational environments. However, this alignment is far from straightforward, particularly in sectors where safety-critical systems are also exposed to cyber threats, and where compliance must extend across diverse supply chains. In fact, the increasing convergence of functional safety and cybersecurity requirements introduces a significant challenge for industrial sectors operating under both domain-specific standards and emerging EU regulations. This paper examines the practical implications through three industrial use cases from the energy, telecommunications, and manufacturing sectors. Each use case highlights the interplay between vertical safety standards (e.g., IEC 61508, ISO 10218, ISO/TS 15066, SEVESO), cybersecurity frameworks (e.g., IEC 62443, PCI DSS), and EU-wide legislative requirements. The paper identifies cross-sector patterns and highlights the need for harmonized approaches to risk management and compliance in both the safety and cybersecurity domains. It contributes to a strong foundation to share practical challenges from real-world integration, which leans towards a novel, harmonized co-assurance and continuous certification framework.