Entry into force
Regulation (EU) 2024/2847 enters into force.
Cyber Resilience Act · Advisory for manufacturers · Regulation (EU) 2024/2847
Cyber Resilience Act advisory for clear product decisions.
For connected-product manufacturers, the Cyber Resilience Act is not a documentation exercise in isolation. It changes decisions across product development, security and service. I help you turn that into a credible course of action for your business.
Through Cyberstand, I contribute to CRA-related standards work in national DIN and European CEN/CENELEC committees.
Senior CISO-level advisory
CRA standards committee experience
ISO/IEC 27001 Lead Auditor
What changes for manufacturers
Product security becomes an end-to-end manufacturer responsibility.
The CRA links cybersecurity to placing products with digital elements on the market. Requirements for secure development, vulnerability handling, support and conformity reach into established product and operating models.
The management question is not simply which rule applies. It is: who decides, who owns the evidence, and how do product teams keep moving?
Article 14 reporting obligations
Apply since this date; reporting workflows and ownership must now work reliably.
General application
CRA requirements generally apply; product-specific transition and exception provisions still matter.
Two workstreams
Build response capability and long-term readiness in parallel. Reporting routes and escalation need near-term clarity. Product strategy, development, support and governance also need to prepare for the wider requirements.
Where the work gets stuck
The difficult questions sit between teams.
Regulatory requirements become actionable only when product, engineering, security and leadership share the same language, ownership and priorities.
- Unclear product boundaries: portfolio, components and ownership are not visible from a shared view.
- Split accountability: development, product security, service and compliance each expect another team to move first.
- Existing processes lack product context: ISMS and supplier controls do not automatically extend across the product lifecycle.
- Priorities under deadline pressure: teams see the need to act but not which decisions will make the greatest difference first.
- Evidence arrives too late: decisions and security work are not connected early enough to traceable information.
The advisory engagement
Create clarity. Anchor decisions. Enable delivery.
Direct work with Axel, shaped around your portfolio, maturity and internal capacity. The advisory stays close to real decisions and creates a practical plan rather than a parallel compliance structure.
Build a shared picture
Bring products, objectives, existing security work and open assumptions together with the people responsible.
Make decisions visible
Translate regulatory expectations into concrete questions about ownership, risk acceptance, product planning and operational capability.
Set practical priorities
Define a proportionate sequence, accountable owners and the decisions leadership and specialists need to make.
Enable implementation
Equip your team with clear next actions, decision points and guidance on using existing management systems.
Regulatory precision
Read the obligations accurately without turning every question into a major programme.
Organisation & product
Bring governance and technical work into the decisions that shape real products.
Senior guidance
Direct access to experienced counsel, plain communication and a credible next step.
A good fit
For manufacturers who need to own the outcome, not just tick requirements.
This advisory suits specialist and mid-sized manufacturers whose products include software, firmware, connectivity or digital components, and who need to manage CRA implications with finite internal capacity.
It is especially useful when leadership, product owners or a CTO need a sound direction before committing resources and setting delivery expectations.
Questions manufacturers ask
A few important clarifications.
Which manufacturers benefit from CRA advisory?
For manufacturers placing products with digital elements on the EU market who need to clarify ownership, portfolio implications and a realistic path to readiness. Scope and special rules must be assessed against the actual product and the Regulation.
When do the main CRA dates apply?
Regulation (EU) 2024/2847 entered into force on 10 December 2024. Article 14 reporting obligations apply from 11 September 2026; the Regulation generally applies from 11 December 2027. Transitional and exception provisions must be checked for each case.
How is this different from a CRA compliance programme?
This is cross-functional advisory on direction and governance: aligning leadership, product, engineering and compliance around a shared view and prioritising the next useful step. It is not a detailed product assessment, implementation programme or technical documentation service.
How can we start without launching a large programme?
An initial, no-obligation conversation clarifies your products, existing structures and open decisions. That establishes whether a focused advisory discussion is enough or further support makes sense.
Is this legal advice or a conformity certification?
No. The advisory supports practical interpretation and action from a cybersecurity and governance perspective. It is not legal advice, a conformity assessment or a decision by an appropriate notified body.
A useful next step
Bring your open CRA questions to the table.
A direct conversation with Axel. No sales deck — just your products, your starting point and the decisions in front of you.