CRA readiness for embedded and IoT manufacturers
Assessment and implementation at firmware level, from a single source.
From 11 September 2026, the CRA reporting obligations apply to actively exploited vulnerabilities and severe security incidents. The initial early warning is generally due within 24 hours.
From 11 December 2027, the essential requirements of the Cyber Resilience Act apply to products in scope, including conformity assessment and CE marking.
Request a free intro callWhich market this page is about
The Cyber Resilience Act is EU regulation and applies across all member states. What I advise on is the concrete implementation for the German market: the German authorities and notified bodies, the documentation practice expected here, and — where legal questions arise — our German partner law firm. I work with you in English, but the regulatory context I know inside out is the German one.
Does any of this sound familiar?
- • You are not sure whether your products fall under the CRA and in which class
- • An SBOM for your firmware does not exist, or only on paper
- • For the 24-hour reporting duty there is no process and nobody in charge
- • Firmware updates in the field are possible, but neither signed nor secured
- • Your compliance consultant understands paragraphs, but not firmware
What I do for you
Scope check
One day of analysis plus a written report: which product class, which obligations, which deadlines. Fixed price, credited against a follow-up engagement.
Gap analysis, Annex I
Your products checked against the essential requirements of the CRA, at firmware level rather than on documents alone.
Reporting process by 11 September 2026
A working process for the 24-hour early warning, the subsequent 72-hour notification and the final report: roles, procedures, templates. Tested, not just described.
Implementation in firmware
SBOM pipeline, secure boot, signed updates, vulnerability handling. This is the part you cannot read up on.
For clarity: I advise and prepare things technically, the legal advice is provided exclusively in cooperation with our partner law firm. The declaration of conformity, CE marking and liability remain with the manufacturer. For most products an internal conformity assessment is possible. Certain important products may require a notified body; for critical products third-party assessment is generally mandatory.
Reference: IoT series product with secure OTA
For torcbrain I developed large parts of the software of an IoT cordless high-torque screwdriver: embedded Linux, a secure bootloader with TrustZone-protected M4 firmware IP protection, secure OTA updates, remote management and device administration via the cloud. The system has been in the field for over two years, and idastroem runs the cloud operations to this day. More in the blog.
Your contact
Markus Kräutner
Dipl.-Inf., Managing Director of idastroem GmbH
25 years of software development for electronics and industrial automation. I have shipped secure boot, encrypted firmware and secure OTA updates in series products long before the CRA made them mandatory.
- • Embedded security in series production: cordless tools, dosing technology, industrial controls
- • SBOM, reporting processes and technical documentation under the CRA
- • Embedded Linux, Buildroot/Yocto, STM32, Nordic, ESP32
- • Cloud connectivity and operations, hosted in Germany
Clarify your exposure before 11 September
30 minutes are enough for a first assessment. Free of charge, no obligation. If I cannot help, I will tell you during the call.
Arrange a call nowHow we work together
Free intro call
30 minutes: products, connectivity, deadlines. Afterwards you know whether you need to act.
Scope check at a fixed price
One day of analysis plus a written report with product class, obligations and priorities. Fixed price, credited against a follow-up engagement.
Implementation
Gap analysis, reporting process, SBOM pipeline or firmware hardening, depending on what the check turns up. With clear milestones.