Cybersecurity for scanners, printers and mobile computers
What applies, and from when
Two sets of rules turn the insight that every device is an endpoint into an obligation: the German NIS2 Implementation Act for operators and the European Cyber Resilience Act for manufacturers.
In Germany, the NIS2 Implementation Act is in force. Important and essential entities must operate risk management, report incidents and take the security of their supply chain into account.
Since this date, the Cyber Resilience Act’s reporting obligations apply to actively exploited vulnerabilities in products with digital elements.
From then on, the Cyber Resilience Act’s product requirements apply in full. Among other things, manufacturers must define a support period for security updates.
We are not a legal adviser and do not replace an information security management system. Whether your company falls under the German NIS2 Implementation Act is clarified by the BSI applicability check. We make sure the devices in your facility meet the requirements that follow from it.
Why scanners and printers are coming into focus
For a long time, identification hardware was chosen for reading speed, print quality and ruggedness. That is no longer enough. Today a mobile computer is a networked device with apps, Wi-Fi access and ERP credentials. A label printer has a network interface and firmware. Every device that posts to the ERP is a way into it.
The decisive question is organisational, not technical: who manages the label printer at the dock, who the mobile computer in the high-bay rack? Are they in the same inventory as the office laptop, with software version and update cycle? Where the answer is no, the risk starts with the missing overview.
Not covered by NIS2? You may still be affected through your customers. Companies covered by the law must take the security of their supply chain into account and ask their suppliers about it.
Device, network and data flow belong together
Security in AutoID does not come from a single product. It comes from planning three layers together.
Operating system, firmware, apps and the question of how long the manufacturer supplies security updates.
Wi-Fi coverage, separation of office and production networks, monitoring during operation.
Who posts what to the ERP, who may change label templates and printer configurations, and can this be traced?
Only when these three layers are aligned does an environment emerge that is both efficient and resilient.
What this means for hardware, software, service and consumables
A device without security updates remains a risk, even if it still scans perfectly. When purchasing, ask until when the manufacturer commits to updates. With the Cyber Resilience Act, this information becomes a manufacturer obligation.
With mobile device management, apps, operating systems and security policies are managed centrally. Devices can be locked remotely when needed. Label templates come from one source, with clear rights on who may change them.
Monitoring and updates belong in day-to-day operation, not in a project every few years. With defined response times and a pool of replacement devices, the process keeps running even when a device has to be taken out of service.
If systems are disconnected after an incident, labelling must continue. That requires a plan for which labels and ribbons are kept on site and which printers can print in emergency mode without a central connection.
Five questions about your device fleet
Whatever you can answer with a confident yes today is done. Every other question is a good starting point.
- Is there a complete inventory of all scanners, mobile computers and printers, with location and software version?
- Do you know, for every device, until when the manufacturer supplies security updates?
- Are updates distributed centrally, and can you see which device has not received them?
- Are the devices in warehouse and production separated from the office network?
- Is it defined who may change label templates and printer configurations, and can every change be traced?
What OPAL adds
Frequently asked questions
Do scanners and printers fall under the Cyber Resilience Act?
Networked hardware and software placed on the EU market counts as a product with digital elements. The obligations fall primarily on manufacturers. For you as an operator, the committed support period therefore becomes a fixed selection criterion.
Our company is not covered by NIS2. Does this still affect us?
Possibly through your customers. Companies covered by the law must take the security of their supply chain into account and ask their suppliers about it.
What should we do with devices that no longer receive security updates?
First record where they are and what they do. Then plan the replacement and, until then, limit access to what is necessary. A replacement can be organised so that operations keep running.
What should we look for when purchasing?
Ask about the support period before the price: until when does the manufacturer supply security updates? Under the Cyber Resilience Act, manufacturers must define this period.
Does OPAL replace legal advice or an ISMS?
No. We are not a legal adviser and do not replace an information security management system. We make sure your devices in warehouse and production meet the requirements that follow from them.
Sources, as of October 2026: Regulation (EU) 2024/2847 (Cyber Resilience Act), BSI: NIS-2 regulated companies. This page is general information and does not replace legal advice.