Analysis and practical guidance on the EU Cyber Resilience Act. Regulation explainers, SBOM tooling, vulnerability workflows, and ENISA reporting, written for manufacturers, importers, and distributors.
Country brief for Polish manufacturers under the CRA: CSIRT NASK routing, PCA accreditation, KSC overlap, Polish-language duties, and FENG/KPO funding.
Country brief for Italian manufacturers under the CRA: ACN as planned authority, ACCREDIA accreditation, OCSI/EUCC, Italian-language duties, and Transizione 5.0 funding.
Country brief for Dutch manufacturers under the CRA: NCSC reporting, intended RDI market surveillance, RvA accreditation, Warenwet language rule, Rotterdam.
Country brief for French manufacturers under the CRA: CERT-FR routing, ANSSI as notifying authority, ANFR for market surveillance, COFRAC accreditation.
Country brief for Spanish manufacturers under the CRA: likely INCIBE-CERT reporting, the planned CCN/ENAC notified-body split, Spanish-language duties, and funding.
Cyber Resilience Act key dates: reporting has applied since 11 September 2026 and main obligations apply from 11 December 2027.
Get notified when we publish new articles about CRA compliance and product security.
