What the Proposed Cybersecurity Act 2 Would Change
On January 20, 2026, the European Commission presented its proposal for a new Cybersecurity Act. The regulation would fully replace the Cybersecurity Act (CSA) of 2019 and bring one fundamental …
Category - Regulation
CEMA Guidance on CRA Compliance for Agricultural Machinery
In December 2025, CEMA, the European association of agricultural machinery manufacturers, published guidance on interpreting the Cyber Resilience Act. The document addresses the main questions of interpretation that arise when …
European Commission Publishes FAQ on the Cyber Resilience Act
The European Commission has published a document with answers to frequently asked questions on the Cyber Resilience Act. On 66 pages, it answers central questions about implementing the regulation. It …
Implementing Regulation (EU) 2025/2392 Defines CRA Product Categories
On November 28, 2025, the European Commission adopted Commission Implementing Regulation (EU) 2025/2392. It sets out the technical descriptions of the product categories listed in Annexes III and IV of …
EN 40000: The Horizontal Standards for the CRA
This article describes the status as of October 2025, when the first EN 40000 drafts were released for comment. For the current status, see our pages on the EN 40000 …
ETSI Draft Standards for the Cyber Resilience Act
This article describes the status as of September 2025, when ETSI published early drafts (versions 0.0.x) for consultation. For the current status, see our overview of harmonized standards for the …
How the CRA and the Machinery Regulation Overlap
Status note (October 13, 2026): This article describes the situation in May 2025, and its facts are as of that date. Two points have moved on since then. The CRA's …
ISO/IEC 42001 as a Management System for Artificial Intelligence
As more industries use artificial intelligence (AI), the demand for clear rules and guidance grows. Companies must develop and use AI systems responsibly, securely, and efficiently. The standard ISO/IEC 42001 …
CRA Transition Periods and Key Dates
This article was first published on November 20, 2024, the day the CRA appeared in the Official Journal. The timeline reflects the status as of October 2026. For the full …
IoT Cybersecurity Regulation in the United States
The United States has no single law for the cybersecurity of Internet of Things (IoT) devices. Federal initiatives, state laws, and voluntary standards together form the rules that IoT manufacturers …