Category: Articles

As digital products become increasingly connected, cybersecurity is no longer optional, it is a business necessity. The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, establishes common cybersecurity requirements for products with digital elements across the European Union. By introducing security-by-design principles, vulnerability management obligations, and greater transparency for users, the CRA aims to strengthen the resilience of the EU’s digital ecosystem. While the Regulation will become fully applicable from 11 December 2027, key obligations start earlier, making it essential for manufacturing SMEs to begin preparing now. To help businesses better understand the new requirements, MANTRA has gathered insights from cybersecurity experts across Europe. Acknowledgements: MANTRA would like to thank SECURE – Cyber Resilience for SMEs for contributing their expertise and practical insights to this article. Their perspectives help clarify the implications of the Cyber Resilience Act for manufacturing SMEs and provide concrete guidance on how organisations can begin their compliance journey  The Cyber Resilience Act is reshaping the way digital products are designed and managed. What should manufacturing SMEs know about the regulation, and why is it important to start preparing now? The key message is that the Cyber Resilience Act turns cybersecurity from a voluntary good practice into a legal product requirement. The CRA applies to a wide range of hardware and software made available on the European market. Manufacturing SMEs should therefore not assume that it concerns only software companies. Connected machinery, smart sensors, control systems and other products containing digital components may also fall within its scope. Manufacturers will need to manage cybersecurity throughout the product’s lifecycle. In practice, this means assessing cyber risks, designing products securely, controlling vulnerabilities in components and software libraries, providing security updates, handling vulnerability reports and maintaining the necessary technical documentation. Before placing a product on the market, manufacturers must also demonstrate conformity with the CRA and apply the CE marking. The applicable assessment procedure will depend on the type and risk category of the product. Preparation is now urgent. From 11 September 2026, manufacturers must report actively exploited vulnerabilities and serious security incidents. An initial warning may be required within 24 hours and a more detailed notification within 72 hours. The main product-security and conformity obligations will apply from 11 December 2027. European Commission – CRA reporting obligations For many SMEs, compliance will require changes to product development, supplier agreements, update mechanisms, documentation and incident-response processes. These changes cannot realistically be introduced just before the deadline. Companies should start by identifying which products are covered, clarifying their role in the supply chain, assigning internal responsibility and comparing their current practices with the CRA requirements. The CRA should not be approached as a one-off certification exercise. It requires manufacturers to remain responsible for the cybersecurity of their products after they have been sold. Starting early reduces compliance costs, limits last-minute redesigns and helps ensure continued access to the European market. What are the biggest challenges or misconceptions that manufacturing SMEs face when approaching CRA compliance? The biggest challenge is that many manufacturing SMEs still view the CRA as an IT or administrative compliance exercise. In reality, it affects product design, engineering, procurement, after-sales support and management responsibility. A first misconception is: “We manufacture machines, not software.” The CRA covers hardware and software products with digital elements, including connected machinery, sensors, controllers, embedded software and components sold separately. A traditional manufacturer may therefore fall within scope even if software is only one part of its product. A second misconception is that good organisational cybersecurity—or compliance with NIS2 or ISO 27001—automatically means CRA compliance. These measures can help, but the CRA focuses specifically on the security of the product. The manufacturer must assess product-related cyber risks and demonstrate how these risks are addressed. A third challenge is supply-chain visibility. Manufacturers often depend on third-party software, chips, libraries and connected services without having sufficient information about their vulnerabilities or update policies. Outsourcing a component does not remove the manufacturer’s responsibility for the security of the final product. Another common mistake is treating compliance as a one-off test before placing the product on the market. The CRA requires security throughout the product lifecycle. Manufacturers must be able to receive vulnerability reports, provide security updates, manage incidents and support the product for the declared support period. There is also uncertainty about conformity assessment. Not every product automatically requires expensive third-party certification; the applicable procedure depends on the product’s classification and risk profile. However, every manufacturer will need adequate risk assessments, technical documentation and evidence of compliance. Finally, many SMEs are waiting for all standards and guidance to be finalised. That is risky. They can already take “no-regret” steps: identify products in scope, map digital components and suppliers, assign responsibilities, introduce secure development practices and establish vulnerability and update processes. These foundations take time and will be necessary regardless of the final technical standards. Many SMEs believe compliance is expensive and complex. What free or accessible tools, training resources, standards, or support initiatives already exist to help them? The cost concern is understandable, but SMEs do not need to begin with an expensive compliance platform or consultancy project. A growing range of free and accessible resources is already available. In Belgium, the CCB provides CRA information in Dutch, French and German. Through the EU-funded SECURE project, the CCB has also developed practical resources for SMEs: a beginner-friendly “CRA 101” guide, technical guidance on the essential cybersecurity requirements, a methodological compliance-assessment framework containing checklists, examples and references to useful tools, and a CRA Maturity Score tool to help mSMEs assess where they currently stand in terms of compliance and what gaps need closing. Additionally, Trainings are freely available and being produced on a rolling basis, and through SECURE, European mSMEs can receive funding to support their CRA compliance. At European level, the European Commission provides FAQs and practical guidance explaining issues such as product scope, risk assessment, support periods, reporting and substantial modifications. These should be the starting point for interpreting the regulation. ENISA offers particularly useful free resources, for example: The Secure by Design and Default Playbook translates product-security principles into concrete engineering actions and examples of supporting evidence. ENISA also provides instructions and FAQs for the CRA Single Reporting Platform, which manufacturers will use to report actively exploited vulnerabilities and serious incidents. Several EU-funded initiatives provide or are developing open-source tools, training, templates and compliance-assessment support. These can help with subjects such as product-risk assessments, technical documentation, software bills of materials, vulnerability management and security testing. SMEs should check the project portals regularly, as available tools, training sessions and funding opportunities evolve. Existing standards such as IEC 62443 for industrial systems and ETSI EN 303 645 for consumer IoT can also provide useful technical building blocks. However, using a standard does not automatically prove CRA compliance. Only harmonised standards formally recognised under the CRA can provide a presumption of conformity for the requirements they cover. The CCB’s CyberFundamentals framework and Safeonweb@work resources can help SMEs strengthen their general organisational cybersecurity. They are valuable foundations, but they should not be confused with a complete CRA product-compliance assessment. Our advice is therefore to use the free resources first to determine scope, assess gaps and create an implementation roadmap. Specialist support can then be reserved for areas where it adds real value, such as product classification, conformity assessment or specialised security testing.  If you could recommend just three practical actions that an SME should take today to begin its CRA journey, what would they be? 1.Identify your products in scope and assign ownership Create a simple register of the products and versions you place on the EU market, including their software, connected functions and third-party components. Record your role—manufacturer, importer or distributor—and make an initial assessment of the likely product classification and conformity route. Appoint one responsible CRA coordinator, supported by engineering, quality, procurement and legal staff. 2. Perform a gap assessment on one priority product Select a representative or high-risk product and compare its current design and lifecycle processes with the CRA’s essential cybersecurity requirements. Map its architecture, interfaces, software dependencies, suppliers, update mechanisms and existing security measures. Document the risks, gaps, actions and available evidence. Starting with one product creates a repeatable method that can later be applied across the portfolio. 3. Make vulnerability handling and reporting operational Establish a clear contact point for vulnerability reports and define how the company will monitor, assess, correct and communicate vulnerabilities. Include supplier escalation, security updates, customer communication and regulatory reporting. Test the process using a realistic scenario: could the company identify affected products, take decisions and submit an early warning within 24 hours? This third action is particularly urgent because the CRA reporting obligations apply from 11 September 2026, ahead of the full application of the remaining requirements in December 2027. These actions should produce three tangible results: a product register with clear ownership, a prioritised compliance roadmap and a tested vulnerability-response process. That is a much stronger starting point than collecting legal documents without changing how products are designed and supported. Contributor: Yves Streel SECURE Senior Project Manager NCC-BE department at the Centre for Cybersecurity Belgium

Europe’s manufacturing SMEs are facing unprecedented challenges. Rising energy costs, increasing sustainability requirements, rapid technological change, and global competition are reshaping the industrial landscape. To remain competitive, SMEs need more than isolated solutions. They need access to a strong innovation ecosystem that supports their transformation from multiple perspectives. This is where European collaborative initiatives such as MANTRA and GreenMantis play an important role. By addressing different aspects of industrial transformation, they contribute to a broader European ecosystem that helps manufacturing SMEs embrace the twin transition towards a more digital, sustainable, and resilient future. This is a collaborative article between two projects, MANTRA and GreenMantis, as part of their ongoing synergy (October 2026).  MANTRA: Empowering SMEs through Digital, Circular and Social Innovation MANTRA supports manufacturing SMEs in accelerating their transformation by combining advanced digital technologies, circular economy principles, and social innovation. The project is specifically designed for traditional manufacturing SMEs with low levels of technology uptake that are seeking to modernise their operations, improve sustainability, and strengthen their long-term competitiveness. Focusing on six manufacturing sectors, namely machinery, food, textiles, plastics, ceramics, and metals, MANTRA connects SMEs with technology providers, innovation experts, and business support organisations capable of guiding them through their transformation journey. The project promotes the adoption of a broad range of advanced technologies, including artificial intelligence, robotics, the Internet of Things (IoT), big data, cloud computing, augmente and virtual reality, blockchain, advanced materials, photonics, nanotechnology, and advanced manufacturing technologies, helping companies identify the solutions that best fitntheir needs. At the heart of the project is a tailored support pathway that accompanies SMEs through four key stages: assessment, matchmaking, advisory services, and implementation support. Through this process, businesses receive specialised guidance on technology adoption, technology transfer, proof-of-concept development, innovation roadmapping, design management, investment readiness, intellectual property management, lean manufacturing, and market expansion strategies. However, MANTRA goes beyond digital innovation. The project recognises that the twin transition requires manufacturers to rethink how value is created, delivered, and sustained. Through dedicated advisory services, SMEs are supported in developing circular business models, integrating social innovation practices, and strengthening their environmental performance. Companies can benefit from sustainability-focused services such as energy assessments, greenhouse gas (GHG) emission calculations, Life Cycle Assessment (LCA), Social Life Cycle Assessment (sLCA), and Life Cycle Costing (LCC), enabling them to better understand and reduce their environmental impact while improving operational efficiency. Collaboration is a fundamental pillar of the MANTRA approach. By fostering cooperation between manufacturers, technology providers, researchers, and innovation organisations, the project helps SMEs access expertise, knowledge, and resources that would otherwise be difficult to obtain. This collaborative ecosystem enables businesses to learn from one another, adopt innovative solutions more effectively, and accelerate their transition towards more sustainable and resilient business models. To support the practical implementation of innovation projects, MANTRA also provides financial support of up to €50,000 per SME. This funding can be used for activities such as feasibility studies, prototyping, pilot testing, demonstration activities, specialised consultancy services, coaching, access to testing facilities, and the deployment of new technological solutions. By combining advisory support with direct financial assistance, MANTRA helps SMEs transform strategic ambitions into tangible results. GreenMantis: Accelerating the Green Industrial Transition Complementing these efforts, GreenMantis focuses on enabling European SMEs to adopt and scale advanced net-zero technologies. By bringing together six leading European clusters across the manufacturing and energy value chains, GreenMantis creates opportunities for SMEs to develop innovative solutions in areas such as electricity grid technologies, energy system-related energy efficiency, and transformative industrial technologies for decarbonisation: Electricity grid technologies are energy network technologies that can automatically monitor energy flows and adjust to changes in energy supply and demand. These technologies can offer users better control over their energy use and losses, enabling more effective management throughout the day and improving the resilience of the overall infrastructure. Energy system-related energy efficiency technologies are designed to reduce the amount of energy required to operate industrial processes and enable more efficient use of energy. Transformative industrial technologies leading to decarbonisation are innovative solutions designed to reduce carbon emissions from industrial processes through carbon avoidance. Their aim is to transform traditional manufacturing processes by making them more efficient. To achieve its objectives, GreenMantis has launched an innovation support scheme providing financial support for collaborative projects developing net-zero solutions. In addition, SMEs can benefit from training and internationalisation services designed to strengthen their skills, expand market opportunities, and enhance their long-term sustainability. The first Open Call was open from March to June 2026. Selected projects received up to €100,000 in equity-free funding to develop innovative energy efficiency solutions and adopt new net-zero technologies for the green transition of European industry. To participate, manufacturing SMEs had to partner with energy SMEs and form a consortium to both provide and adopt net-zero technologies. Following the success of the first Open Call, GreenMantis is planning to launch a second Open Call in the first half of 2027 to fund innovative projects at Technology Readiness Levels (TRLs) 6-8 for a duration of nine months. Similarly to the first Open Call, each project will require the creation of a consortium of European SMEs and will receive up to €100,000 in funding. The activities to be funded will be related to the development of new products or services, including technology development and prototyping (TRL 6–8), pilot testing and validation in operational environments, demonstration activities, integration of net-zero technologies into manufacturing processes, and business process innovation directly linked to technological adoption. These activities will have to address at least one of the three GreenMantis objectives: Electricity Grid Technologies Energy System-Related Energy Efficiency Technologies Transformative Industrial Technologies Leading to Decarbonisation Beyond project development, GreenMantis’s support for the green transition of European industry will also focus on business process innovation within manufacturing SMEs. By enabling the integration of new organisational methods, operational workflows, and management practices through advanced technologies, SMEs can optimise resource allocation, reduce operational risks, and improve decision-making. These improvements can contribute to greater energy efficiency within manufacturing companies. Furthermore, beneficiaries of the innovation support scheme will also participate in training activities on net-zero technologies for SMEs, an in-person matchmaking event, and an international mission to Canada or Japan. By joining GreenMantis, beneficiary SMEs will have the opportunity to take part in a comprehensive programme that not only enables them to develop new products, services, and processes, but also to connect with new partners, engage with relevant stakeholders, and expand their business networks. GreenMantis therefore provides a concrete opportunity for SMEs to grow their businesses while contributing to the decarbonisation of European industry. Building a Stronger Innovation Ecosystem for European Manufacturing The challenges facing manufacturing SMEs cannot be addressed by a single initiative. Digitalisation, circularity, social sustainability, energy efficiency, and decarbonisation are deeply interconnected. Projects like MANTRA and GreenMantis demonstrate the value of European collaboration in building an innovation ecosystem where complementary initiatives work together to support SMEs throughout their transformation journeys. While MANTRA helps companies adopt advanced technologies, develop circular business models, improve sustainability performance, and strengthen organisational resilience, GreenMantis supports the deployment of innovative net-zero solutions that accelerate industrial decarbonisation. Together, these initiatives connect businesses with expertise, technologies, funding opportunities, training, and international networks, creating the conditions for more competitive and future-ready manufacturing ecosystems across Europe. As Europe continues to advance towards its industrial and climate ambitions, fostering collaboration between initiatives such as MANTRA and GreenMantis will be essential to ensure that manufacturing SMEs have the knowledge, resources, partnerships, and innovation capacity needed to successfully navigate the twin transition and contribute to a more sustainable future for European industry This article was written by Angelica Marsico, Communication Manager at EIT Manufacturing South and Luca Tarantino, Research, Innovation and Sustainability Officer at Consindustria Emilia.

As digital products become increasingly connected, cybersecurity is no longer optional, it is a business necessity. The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, establishes common cybersecurity requirements for products with digital elements across the European Union. By introducing security-by-design principles, vulnerability management obligations, and greater transparency for users, the CRA aims to strengthen the resilience of the EU’s digital ecosystem. While the Regulation will become fully applicable from 11 December 2027, key obligations start earlier, making it essential for manufacturing SMEs to begin preparing now. To help businesses better understand the new requirements, MANTRA has gathered insights from cybersecurity experts across Europe. Acknowledgements: MANTRA would like to thank CyberStand and Cyber Cert Labs for contributing their expertise and practical insights to this article. Their perspectives help clarify the implications of the Cyber Resilience Act for manufacturing SMEs and provide concrete guidance on how organisations can begin their compliance journey. The Cyber Resilience Act is reshaping the way digital products are designed and managed. What should manufacturing SMEs know about the regulation, and why is it important to start preparing now? CyberStand: Manufacturing SMEs should understand that the Cyber Resilience Act introduces cybersecurity requirements for hardware and software placed on the EU market. It covers product security throughout the lifecycle, meaning products must be designed, updated and maintained with cybersecurity in mind. Preparing now is important because compliance is not only a final certification exercise. It may require changes to product development, risk assessment, vulnerability handling, technical documentation and post-market support. For SMEs, the practical first step is to identify which products are in scope, assess existing cybersecurity processes and follow the Commission’s guidance and the development of harmonised standards. These standards are intended to support implementation and help manufacturers demonstrate conformity with the CRA’s requirements. Cyber Cert Labs: The most important thing to understand is how broad the CRA is: it applies to virtually any product with digital elements placed on the EU market, from connected machinery and industrial sensors to consumer devices and software, and the CE mark elevates cyber security to a health and safety issues by linking it to the New Legislative framework. Manufacturers must build products that are secure by design, manage vulnerabilities throughout a defined support period, and provide users with security updates and clear information. The reason to start now is the timeline. While the regulation applies in full from 11 December 2027, the vulnerability and incident reporting obligations apply from 11 September 2026, which means manufacturers need working processes to detect, assess and report actively exploited vulnerabilities and severe incidents to the authorities within tight deadlines, starting with a 24 hour early warning. Those processes, and the design, documentation and testing work behind full compliance, take months to put in place, so an SME that starts in 2027 has already left it too late. What are the biggest challenges or misconceptions that manufacturing SMEs face when approaching CRA compliance? CyberStand: The biggest challenge is often treating CRA compliance as a one-off certification exercise. In reality, the CRA covers cybersecurity throughout the product lifecycle: products must be designed, updated and maintained with security in mind. Another misconception is that compliance is mainly an IT responsibility. It also affects product development, risk assessment, technical documentation, vulnerability handling and post-market support. For SMEs, the key difficulty is therefore integrating these requirements into existing engineering and business processes without creating unnecessary complexity. Finally, many companies assume they should wait until every harmonised standard is available. Standards will be important because they can provide practical guidance. However, SMEs can already start by mapping products in scope, clarifying internal responsibilities and reviewing their current security and vulnerability-management processes. Cyber Cert Labs: The most common misconception is that the CRA does not apply to them, because they see themselves as a manufacturer of pumps, sensors or safety equipment rather than a technology company or they do not see themselves as a manufacturer for instance a company with a phone app is in scope. The second is assuming existing work already covers it: companies with EN 18031 conformity under the Radio Equipment Directive, or an ISO 27001 certificate, often believe they are done, while some security schemes are helpful, they do not provide full coverage, and our gap analysis consistently shows additional CRA obligations around vulnerability handling, support periods and reporting. Third, many treat the CRA as a documentation exercise to complete before shipping, when it is really a set security processes and tasks that need to be embedded into your manufacturing or product development process and they need to continue for the life of the product. Finally, some SMEs are waiting for the harmonised standards to be finalised before acting. We contributed directly to CEN and CENELEC JTC 13 Working Group 9 where those standards are being developed, and our clear advice is not to wait: the draft standards already show the direction of travel and can be used to build compliance evidence today. Many SMEs believe compliance is expensive and complex. What free or accessible tools, training resources, standards, or support initiatives already exist to help them? CyberStand: There are already several accessible forms of support. The European Commission provides a dedicated CRA implementation website, FAQs and practical guidance, including examples specifically designed to make compliance clearer and more proportionate for SMEs. ENISA has also published a free SME Cyber Resilience Maturity Assessment Model, which companies can use to assess their current practices, identify gaps and prioritise improvements. Its European Vulnerability Database provides reliable information on known vulnerabilities, mitigation measures and exploitation status. In addition, several EU-funded projects are developing practical tools, training and guidance specifically for SMEs. For example, OSCRAT is building an open-source, freely accessible tool to help European companies assess their cybersecurity systems in compliance with CRA provisions. CRA-AI is developing three solutions: Attestra, an AI-native product security and compliance platform purpose-built for CRA conformity; Attestra Academy, an online CRA training programme for product owners, engineering, and compliance teams; and PinSpot, covering vulnerability management, penetration testing, and secure code analysis, with API integration into Attestra. The SECURE project has developed guidelines to help SMEs understand CRA obligations, essential cybersecurity requirements, and a methodological compliance framework, along with a CRA maturity score tool and video lessons and training. The key message is that SMEs do not need to build their compliance approach from scratch. They can already use public guidance, assessment tools, training and EU-supported initiatives to begin preparing in a structured and proportionate way. Cyber Cert Labs: There is more support available than most SMEs realise, much of it EU funded, and in some cases, there is direct money specifically for the CRA implementation. The EU-funded SECURE project provides cascade funding of up to €30,000 per company to co finance CRA compliance work: its first open call ran in early 2026 and further calls are expected in autumn, so SMEs should register their interest at secure4sme.eu now to be ready for the next window. Notably, SECURE rewards proposals that make use of tools from other EU CRA projects, which is exactly what CRA-AI provides. Through CRA-AI, co funded by the Digital Europe Programme, we offer a free CRA readiness assessment and scope assessment so any company can establish in minutes whether the CRA applies to its products and where it stands today, plus a free webinar series, with a new series launching in September 2026 covering real case studies, and our EU wide SME market maturity scan. Attestra, our AI powered product security and compliance platform, is live now focused first on the September 2026 reporting obligations, and Attestra Academy provides fully online training built around ten modules covering all the CRA requirements. Beyond that, ENISA and the European Commission publish guidance on scope and reporting, the draft harmonised standards give a clear technical direction, and the National Coordination Centres in each member state can point SMEs to national support. If you could recommend just three practical actions that an SME should take today to begin its CRA journey, what would they be? CyberStand: First, map your product portfolio. Identify which hardware, software and components may fall within the CRA, determine your role in the supply chain, and check whether any products belong to an important or critical category. Second, carry out a cybersecurity risk assessment for one priority product. Review how security is addressed across design, development, production and maintenance, and document the main risks, existing controls and gaps. The European Commission identifies risk assessment as the manufacturer’s first step. Third, establish a basic vulnerability-handling process. Assign responsibilities, create a channel for receiving vulnerability reports, define how issues will be assessed and corrected, and prepare for the CRA reporting obligations. The objective is not to complete compliance immediately, but to understand the scope, identify the most significant gaps and put clear ownership in place. Cyber Cert Labs: First, scope and classify your product portfolio: establish which products are in scope of the CRA and whether they fall into the default, important or critical category, because everything else, from the applicable requirements to the type of conformity assessment, flows from that answer, and a free scope assessment makes this a fast exercise. Second, prepare for the reporting obligations that arrive on 11 September 2026: put a vulnerability intake and triage process in place now and make sure someone in the business knows how to make the required notifications within the 24 hour early warning deadline. Third, run a gap analysis of your current security and conformity work against the CRA essential requirements, using your existing RED, EN 18031 or quality system work as the baseline, so you turn a regulatory worry into a concrete, costed plan, and train your team so the knowledge sits inside the business rather than with an external consultant. Contributors: Luigi Colucci; Project manager Trust-IT Services S.r.l.; Conor McGoveran CPO and Co-Founder, Cyber Cert Labs, coordinator of the EU funded CRA-AI project (Digital Europe Programme); Patricia Shields CEO and Co Founder, Cyber Cert Labs, coordinator of the EU funded CRA-AI project (Digital Europe Programme). September 2026