CRA Vulnerability and SBOM Obligations along the Supply Chain
If you buy a machine, you buy the machine. Not the controller inside it, not the bus system, not a supplier's embedded firmware. This distinction regularly causes confusion under the …
All articles
Germany's CRA Implementation Act and the Role of the BSI
The Cyber Resilience Act (Regulation (EU) 2024/2847), or CRA, applies directly in every EU Member State. Each Member State still decides which national authorities enforce it. This article uses Germany …
The Proposed Cloud and AI Development Act
On June 3, 2026, the European Commission published its proposal for a Cloud and AI Development Act. The proposed regulation introduces the first EU-wide harmonized sovereignty framework for cloud services …
How TARA, Threat Models, and Cybersecurity Risk Assessments Differ
Risk assessment, risk management, threat model, threat analysis, TARA, cybersecurity risk assessment: these terms come up again and again in projects for connected products. Sometimes they mean the same thing, …
Which Harmonized Standards Apply under the CRA
Manufacturers of machinery, plant, and devices keep asking the same question about the Cyber Resilience Act (CRA): which standard should I apply to demonstrate that I meet the requirements? The …
MDR Cybersecurity Reporting Obligations Close the CRA Gap for Medical Devices
On December 16, 2025, the European Commission presented its simplification proposal COM(2025) 1023 for the Medical Devices Regulation (MDR) and the In Vitro Diagnostic Medical Devices Regulation (IVDR). Most attention …
Repeal of the RED Delegated Act and the Transition to the CRA
On April 29, 2026, Commission Delegated Regulation (EU) 2026/339 was published in the Official Journal of the European Union. It repeals the RED Delegated Act (Commission Delegated Regulation (EU) 2022/30) …
What the Proposed Cybersecurity Act 2 Would Change
On January 20, 2026, the European Commission presented its proposal for a new Cybersecurity Act. The regulation would fully replace the Cybersecurity Act (CSA) of 2019 and bring one fundamental …
ISO 24882: Cybersecurity for Agricultural Machinery and Tractors
ISO 24882 “Agricultural machinery, tractors, and earth-moving machinery – Product cybersecurity” is currently at draft stage (ISO/DIS 24882). As the European draft prEN ISO 24882:2025, it already plays a concrete …