Implementing the Machinery Regulation and the CRA as One Project
Take a connected machine controller with remote maintenance access that you place on the market from 2027. It falls under two EU acts at once: the Machinery Regulation and the …
All articles
How to Plan Your CRA Compliance Budget
The Cyber Resilience Act (Regulation (EU) 2024/2847), or CRA, applies in full from December 11, 2027 . The budgets that cover this date fund exactly the period in which the …
When IEC 62443 Certification Makes Sense under the CRA
Many manufacturers assume that the Cyber Resilience Act (Regulation (EU) 2024/2847), or CRA, forces them to get IEC 62443 certification. It does not. For a large share of products, the …
Creating an SBOM for the CRA
Many see the software bill of materials as the big hurdle in the Cyber Resilience Act. They picture an elaborate scan, an expensive tool, and an endless list. A close …
How the CRA Reporting Process Works in Practice
Since September 11, 2026, manufacturers must report actively exploited vulnerabilities and severe incidents via ENISA's Single Reporting Platform. Filling in the form on the platform is quick. The harder part …
Choosing the Right IEC 62443 Security Level for Your Product
Manufacturers working with IEC 62443 often ask one question first: “Which security level does our product have to meet?” The short answer is that you do not decide this alone. …
CRA Reporting Deadlines for Vulnerabilities and Severe Incidents
Since September 11, 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents through the central EU reporting platform. Article 14 of the Cyber Resilience …
CRA Reporting Obligations for Products Already on the Market
Most manufacturers have December 11, 2027, in their plans: the date from which all requirements of the Cyber Resilience Act apply in full. Fewer know that one central obligation applies …
Draft Version 3 of the EUCC Agreed Cryptographic Mechanisms
On June 2, 2026, ENISA, the European Union Agency for Cybersecurity, published the draft of version 3 of the “Agreed Cryptographic Mechanisms” for public consultation. This guideline sets out which …