Risk, Evidence and Conformity
summary
The Cyber Resilience Act requires a CE mark backed by traced evidence: keep test artifacts for 10 years, rerun a new declaration whenever a change alters the threat model, and expect 24‑hour reporting of active exploits with a 72‑hour remediation window. About 90% default category products get vague guidance so manufacturers must run STRIDE assessments, produce SBOMs (required by Sept 11 2026), and can use an AI‑assisted Fleet style tool to collect evidence.
AI-written summary · about
chapters (13)
- 0:00Cyber Resilience Act intro
- 1:46What the Cyber Resilience Act requires
- 4:14CE marking challenges
- 7:03Compliance evidence
- 10:11Vulnerability reporting
- 13:21Product definition and responsibility
- 16:07Risk assessment with STRIDE
- 18:37Security fixes and ecosystem impact
- 21:05Non-EU compliance
- 23:34Open source and third-party risks
- 26:04Product liability directive
- 27:49September 11 deadline
- 29:17Long-term resilience
related talks
27mEU Cyber Resilience Act: What Every Manufacturer Needs to Know
53mHow To Stay Compliant With and Take Benefits From the EU CRA (Cyber Resilience Act)
22mEU Cyber Resilience Act - A Product Owner’s Approach
59mMerging Security and Compliance: Perspectives on Emerging Regulations and Best Practices
01h 18mEU CRA TL/DR for PSIRTS - What Product Security Needs To Do To Be Compliant with the CRA
27m4 Panel Session - Bridging Policy and Practice
30mThe EU's Cybersecurity Resilience Act (CRA) has Begun – How Can Manufacturers Confidently Addres ...
17mFrom lost luggage to lost control - How the Cyber Resilience Act will reshape IoT