EU Cyber Rules Force Industrial Firms to Rethink Legacy Hardware Security Strategies

The convergence of EU regulations including the Cyber Resilience Act, NIS2, and DORA is creating a compliance crisis for organizations running long-established embedded product lines. Many firms already possess technical awareness of their vulnerabilities — such as legacy chips lacking cryptographic isolation — but lack the decision-making frameworks and funding to act on them. Institutional risk-aversion tends to suppress disclosure rather than drive remediation, while capital allocation processes are poorly suited to handling open-ended compliance costs. Manufacturing companies face a particularly acute challenge, as their product lines are tied to long depreciation cycles and capital-intensive supply chains. The paper argues that the transition must be treated as a managed capital process, with interim technical measures used to extend compliant service life rather than forcing abrupt, disruptive overhauls.