Analysis and practical guidance on the EU Cyber Resilience Act. Regulation explainers, SBOM tooling, vulnerability workflows, and ENISA reporting, written for manufacturers, importers, and distributors.
Country brief for Dutch manufacturers under the CRA: NCSC reporting, intended RDI market surveillance, RvA accreditation, Warenwet language rule, Rotterdam.
Country brief for French manufacturers under the CRA: CERT-FR routing, ANSSI as notifying authority, ANFR for market surveillance, COFRAC accreditation.
Country brief for Spanish manufacturers under the CRA: likely INCIBE-CERT reporting, the CCN/ENAC notified-body split, Spanish-language duties, and funding.
May 2026: no Notified Bodies under the Cyber Resilience Act, no harmonized standards, no ENISA platform. Article 14 applies 11 September 2026.
Get notified when we publish new articles about CRA compliance and product security.
