Since 11 September 2026, actively exploited vulnerabilities must be reported within 24 hours.If it applies, how ready are we? Find your CRA gaps (6 questions, 2 min) →Find your CRA gaps
Resources
Start with ten seconds. Go deeper only when you need to. Every piece stands on its own.
The ten-second version
If you sell a connected product in the EU, you must know what is inside it, fix its flaws for as long as you support it, and warn the authorities within 24 hours when one is being exploited.
Six systems make that possible. Most companies already have a home for five of them.
See the six systemsThe CRA sets the duties, not the method. These six systems are our recommended way of meeting them.
A parts list from every build
2A scanner and a 30-minute weekly triage
3Signed, staged, with a stop button
4Inbox, on-call schedule, template
5One person decides, spends and stops
6End dates and warnings, on paper
You do not start from zero. Five of the systems grow out of something your company already runs.
| What you already have | What it becomes |
|---|---|
| The build log | A parts list (SBOM) for every release (1. Know what's inside) |
| The update mechanism | Signed updates, rolled out in stages (3. Ship updates safely) |
| The support inbox | security@ and an on-call schedule that can report within 24 hours (4. Report within 24h) |
| The management meeting | A named CRA owner and a standing agenda item (5. Decide and own) |
| The contracts folder | A supplier register with support end dates (6. Get suppliers to commit in writing) |
The one genuinely new habit is system 2: a weekly 30-minute look at new flaws.
Eight real incidents. The people and scenes are illustrative; the incidents and their facts are real.
Heartbleed · April 2014
The thermostat that went cold · January 2016
The camera above the front door · From August 2016
The day the internet went quiet · 21 October 2016
900,000 routers, one weak spot · November 2016
The supplier who stopped answering · December 2020
Log4Shell, 23:40 on call · December 2021
The half-second delay · March 2024
Verified Sources
Our guidance is grounded in official EU and Danish regulatory sources. Verify any claim directly against the primary legislation and authorities below.
We share practical CRA and cybersecurity notes on Substack.
Latest insights
We share practical CRA and cybersecurity notes on Substack.
Check the scope first, then how ready you are. Both are free.