CRA, Decoded: The Cyber Resilience Act Compliance Guide for Manufacturers, Software Vendors, and Security Teams

The Cyber Resilience Act is the EU's most ambitious product cybersecurity law to date - and most organisations are dangerously underprepared. If your company manufactures, imports, or distributes any product with a digital component - hardware, software, IoT devices, OT systems, or networked equipment - the CRA applies to you. As of 11 September 2026, you are legally required to report actively exploited vulnerabilities and severe security incidents to ENISA within 24 hours. The full compliance deadline, including CE marking and conformity assessment, follows in December 2027. The clock is running. CRA, Decoded is a practical compliance guide written for the professionals who actually do this work: compliance managers, information security officers, product security leads, and GRC consultants who need clear answers fast. This book covers: - Exactly which products are in scope - and which are not - How to classify your products as Default, Class I, Class II, or Critical - and why it matters - What a Software Bill of Materials (SBOM) must contain under CRA - How to build a vulnerability disclosure and incident reporting process that works - The CE marking pathway: conformity assessment, technical documentation, authorised representatives - How CRA overlaps with NIS2, DORA and the EU AI Act - and how to avoid duplicating compliance work >Each chapter is short, structured around a real compliance challenge, and ends with a concrete action list. No theoretical frameworks that don't translate to the real world. No unnecessary repetition. Just the guidance you need to build a defensible CRA compliance programme. Whether you are starting from zero or trying to validate an existing approach, this guide gives you the structure to move forward with confidence. About the author Tiina Vesterinen is the founder of Regulation Decoded and an information security specialist who builds practical GRC automation in her day-to-day work - applying AI to take repetitive compliance work off overstretched teams. A former educator, she founded Regulation Decoded on a single principle: complex regulations deserve clear explanations. She approaches EU cybersecurity law the way a good teacher approaches a difficult subject - breaking it down into what you actually need to do, and in what order. A background in data analytics gives the work its structured, evidence-first backbone. Throughout CRA, Decoded she points to where AI and automation can genuinely lighten the compliance workload - and where they can't - with every requirement cross-checked against Regulation (EU) 2024/2847.