CRA reporting duty: 24 hours, from the moment you know
Article 14 of the Cyber Resilience Act has applied since 11 September 2026 — including to machines already in the field. Which deadlines run, and what you need to answer them.
Siemens put the S7-1500V centre stage at Hannover Messe 2026. The virtual PLC is settled. The follow-up question is not: hardware-free is not vendor-free.

The virtual PLC is no longer a bet. Siemens put the SIMATIC S7-1500V centre stage at Hannover Messe 2026 — a controller without hardware of its own. When the market leader explains a category, the question is no longer whether controllers become software. The question is who owns that software afterwards — and that one does not answer itself.
This article is for machine and plant builders who will decide on their control architecture in the next two or three years.
The S7-1500V is a fully virtual PLC based on the S7-1500. By Siemens’ own product description it is a hardware-independent controller, downloaded as an Industrial Edge app, managed centrally and deployed via the Industrial Edge Runtime; engineering happens in the TIA Portal. The number of instances can be adjusted to demand.
At Hannover Messe 2026, Siemens showed three entry points into software-defined automation: the S7-1500 virtual PLC, Industrial Edge for AI applications, and an open engineering toolchain with package management.
This is not a trade-fair exhibit but a serious move — and it is good for everyone working in this category. A market the largest player explains no longer has to be explained by the smallest.
Today, virtual controllers are a small part of the overall PLC market: IoT Analytics puts it in the low single-digit percentages. For 2030, the same firm considers it possible that a quarter of newly sold PLCs will be virtual or soft PLCs.
That is a forecast, not a measured figure. IoT Analytics names the conditions itself: SIL3 certification would have to be within reach by then, low-speed motion would have to be covered, and at least cold — perhaps warm — redundancy solved.
For your planning, that means two things:
This is the point the category discussion tends to skip. “Independent of the hardware” answers exactly one of two questions:
A virtual PLC solves question 1. Question 2 it can leave open — or ask again in a new form.
| Classic PLC | Virtual PLC inside a vendor ecosystem | Virtual PLC on open standards | |
|---|---|---|---|
| Free choice of hardware | no | yes | yes |
| Free choice of engineering tool | no | no | yes |
| Free choice of operating platform | n/a | no | yes |
| Runs in your own data centre | n/a | limited | yes |
This is not a criticism of Siemens. A vendor who supplies controller, engineering and operating platform from one hand is selling a coherent product that works — and for plenty of plants that is exactly the right choice. It is simply a question to ask before you move rather than after: what precisely have you decoupled once the hardware is gone?
Control software you write today outlives the hardware it starts on. The moment you separate it from the hardware is the same moment you decide what it is embedded in from then on: a file format, an engineering environment and an operating platform. That decision gets made once and carried for fifteen years.
Then there is the regulatory clock. Since 11 September 2026, the Cyber Resilience Act’s reporting duties for actively exploited vulnerabilities apply; it becomes fully applicable on 11 December 2027. Anyone who wants to meet a 24-hour reporting deadline has to know which software version runs on which machine in the field — regardless of whose controller it is. Our Cyber Resilience Act page sets out what that looks like in practice.
At logiccloud, control logic, HMI and connectivity become one automation app. You develop in IEC 61131-3 Structured Text — a standard, not a vendor format. Then, separately, you decide where the app runs:
Infrastructure follows the application, not the other way round. And when the hardware situation changes — lead times, prices, a discontinued device — you change the hardware and keep the software.
More on the logiccloud CONTROL page and, if you are coming from an existing proprietary controller, under replacing proprietary controls.
If you are evaluating a virtual PLC right now, from whoever it is, put this question to the vendor:
If we want to change the operating platform in five years — what exactly do we take with us, and in what format?
The answer tells you more about the next fifteen years than any datasheet will.
See how an automation app is built with us — from Structured Text to running at the edge or in the cloud.
Sources, checked on 12 September 2026