Compliance
ENISA NCAF 2.0: What the 2026 Update Means for CRA
ENISA's NCAF 2.0 (April 2026) is the first update in six years: three new objectives, 871 maturity questions, and explicit CRA references for governments.
CRA Compliance Guides
What the CRA requires you to ship, and who has to do it. Scope decisions, manufacturer and importer duties, technical documentation, conformity assessment, and CE marking, explained article by article.
Compliance
European Cybersecurity Certification Conference 2026: 29 EUCC certs, enough CABs?
ENISA reported 29 EUCC certificates and 28 accredited CABs after EUCC's first year. What that capacity means for CRA conformity assessment.
Compliance
CRA Conformity: Lessons from ENISA's EUDI Wallet Scheme
ENISA's first EU cybersecurity certification scheme requires SBOMs, rejects ISO 27001 alone, and puts suppliers in the certification chain. CRA implications.
Compliance
CRA Commission Guidance: What the March 2026 Draft Means
Archive of the March 2026 CRA consultation draft: 9 clarifications on SaaS, legacy products, open source, and reporting. The July draft now supersedes it.
Compliance
Cybersecurity Act 2 (CSA2): what CRA manufacturers should watch
CSA2 is still a proposal. COM(2026) 11 final would reshape cybersecurity certification, ICT supply chains and ENISA powers.
Compliance
Multi-Role CRA: Manufacturer, Importer, Distributor
CRA playbook for companies that manufacture, import and distribute: role mapping, obligation stacking, vulnerability routing, penalties and conflict points.
Stay in the loop
Get notified when we publish new articles about CRA compliance and product security.