You're not ready for the CRA 2026
who it's for
device manufacturers, compliance officers, product security engineers, embedded software engineers, supply chain managers, incident responders, security managers
topics
SBOM visibility for devices; secure OTA update pipelines; supply-chain CVE monitoring; 24-hour incident reporting; IEC 62443 management practices; vulnerability handling processes; CRA product categorisation; EU and UK dual compliance paths; technical file audit trails; CHERI memory safety adoption; formal verification for boot; update tooling at scale (million+ devices)
| title | author | length |
|---|---|---|
| The CRA roadmap: What to expect | Richard Marshall | 36m |
Regulation readiness requires concrete actions: manufacturers must produce SBOM visibility for every device, implement secure update pipelines capable of… | ||
| The challenge ahead for OEMs based upon the RED Article 3.3 | Simon Dunkley | 29m |
OEMs face no unknown technical bars but a heavy proof problem: compliance requires 100+ pages of technical file and an audit trail from conception to… | ||
| CRA competitive impact for the UK | Joe Lomako | 19m |
The CRA forces companies to change process not just code: it imposes lifecycle vulnerability reporting, secure-by-design requirements tied to IEC 62443… | ||
| Building in cyber resilience | Haydn Povey | 32m |
Claims that software ecology has 25,000 critical vulnerabilities (2025) and causes ~$10.5 trillion/year, with 70% of CVEs being memory‑safety bugs (Chromium… | ||
| CRA panel discussion + Q&A | Richard Marshall | 33m |
Panel identifies three concrete shortfalls: lack of an operational vulnerability handling process (Article 14 deadlines in September and formal handling… | ||
| nothing matches | ||