Blog
Notes on the Cyber Resilience Act and EN 18031 for teams that build connected products.
Your Article 14 clock starts the same day ENISA's reporting platform opens — a playbook for 11 September 2026
The CRA's 24h/72h/14-day vulnerability reporting clocks start on 11 September 2026 — the same day the Single Reporting Platform itself is scheduled to go live, not before. Here's what's confirmed, what isn't, and what you can prepare regardless.
Split your BSP from your libraries: the CRA's Article 13 makes a boring architecture decision mandatory
The Cyber Resilience Act ties your support-period obligation to whatever ships in the image. The fewer things you can't easily update, the cheaper that obligation gets. A practical case for separating bootchain/kernel/HAL from libs/apps/comms stacks.
From esp-idf-sbom to Annex VII: what your firmware SBOM covers for the CRA — and what it doesn't
One command gets you a spec-compliant SBOM for your ESP32 firmware. The CRA's technical file wants a lot more than that. Here is exactly where esp-idf-sbom's output lands in Annex VII, and what you still have to write yourself.
EN 18031 vs the CRA: your connected device is already regulated — and the no-password onboarding trap
The CRA deadlines get the headlines, but if your product has radio and touches the internet, EN 18031 has applied since August 2025. Here is what applies today, what carries over to 2027, and the harmonisation fine print that can force a Notified Body into your project.