The Cyber Resilience Act (CRA) is no longer merely a legislative framework on the distant horizon. It is firmly entering its operational phase.
On August 17, 2026, the European Telecommunications Standards Institute (ETSI) officially launched the approval process for 17 key European standards designed to support the regulation's implementation. These standards cover a broad spectrum, ranging from operating systems to connected objects (IoT), establishing concretely what "security by design" entails for any product with digital elements commercialized within the European Union.
The trap of staggered deadlines: a first milestone before 2027
A particularity of the CRA timeline lies in the phased rollout of its obligations.
Although full enforcement and the mandatory cyber CE marking are set for December 2027, an initial critical deadline arrives much sooner.
Starting September 11, 2026, manufacturers will be required to comply with strict reporting obligations. In practice, this means notifying the competent authorities (such as ENISA or the national CSIRT) of any actively exploited vulnerability and any severe incident within 24 hours.
This temporal discrepancy often catches software vendors and hardware manufacturers off guard, as their internal vulnerability management processes are not yet fully mature or automated.
A paradigm shift for manufacturers and integrators
Unlike NIS2, which primarily targets service operators, the CRA places the burden of proof squarely on the shoulders of digital product manufacturers.
Regulatory expectations no longer focus solely on incident response, but on the continuous demonstration of control across the entire product lifecycle.
This entails precise software dependency mapping (especially open-source components), regular penetration testing, and the capability to supply security patches throughout the product's expected lifespan.
For many SMEs and mid-caps in the technology sector, this requirement for traceability and transparency represents a major organizational and technical challenge, demanding an overhaul of development methodologies.
ITrust expertise supporting product compliance
This regulatory shift creates an immediate need for specialized skills in digital product security assessment.
ITrust positions itself as a trusted partner to guide manufacturers and integrators through this demanding process.
Our approach is built on advanced expertise in application security and vulnerability detection. By integrating our Reveelium solution starting from the development and validation phases, organizations can benefit from a continuous assessment of their security posture.
This predictive detection and behavioral analysis capability serves as a decisive asset for identifying vulnerabilities prior to market release and meeting the requirements of ETSI standards currently being adopted.
Beyond technology, we provide consulting services to structure your vulnerability management processes. The objective is to ensure that CRA compliance is not treated as a mere administrative box-checking exercise, but rather as a true driver of quality, differentiation, and trust for your end customers.
Structuring your approach
Achieving CRA compliance requires a clear understanding of the technical obligations and standards applicable to your product line.
The ITrust teams are available to audit your current processes and assist you in integrating the requirements of the Cyber Resilience Act, well ahead of the December 2027 deadline.
