1. Demystifying the CRA, by Wout Platteau (Timelex)

Wout Platteau opened the afternoon by laying out the legal frame and the timeline. He made the dates clear, because many people still mix them up. These are the dates you should know: CRA entered into force in December 2024. The reporting duties start on 11 September 2026. Full application follows on 11 December 2027. Bottom Line: Don't wait, start now!

The core message: the CRA applies to "Products with Digital Elements" (PDEs). That covers both hardware and software, and also remote data processing solutions. Wout walked through the strict duties before and after an incident. One example stood out. A company must send an early warning about an actively exploited vulnerability within 24 hours. He also showed the cost of getting this wrong. Fines can reach 15 million euro, or 2.5% of worldwide annual turnover. Big discussion here: "What does becoming aware mean?" and "When do you need to send out an early warning?". Obviously, your team will still be figuring out the size and impact of the incident, so it is not easy to answer that question. We hope that the answer becomes a bit clearer as we approach the reporting deadline (September 11th, 2026) but in the meantime, you could read this blog article. It is clear that your incident reporting team must be able to separate noise from fact in hours, not weeks, and report vulnerabilities in days, not weeks.

2. Pitfalls in Practice, an OT View, by Wout De Ceuninck (Spinae)

Wout De Ceuninck brought the talk into the world of Operational Technology (OT). He shared seven common pitfalls that companies hit when they start with the CRA.

The core message: compliance is not a job for IT or Legal alone. It needs real teamwork across R&D, Operations, Quality and Management. He warned about two big traps. The first is not knowing how your own product portfolio is classified. The second is the hard task of patching devices that are already out in the field. His clear advice was similar to that of the other Wout: "Don't wait. Start now!" He also reminded the room that the CRA is product specific. What works for one maker will not always work for another.

3. Pragmatic CRA Compliance, by Maxim Baele (Toreon)

Maxim Baele moved the focus to the engineering floor. He showed how to use the OWASP Software Assurance Maturity Model (SAMM) as a compass for CRA work.

The core message: the CRA is result oriented. It asks for secure outcomes, but it does not hand you a step by step technical manual. So risk assessment and threat modelling become the base of everything. Maxim advised teams to set realistic, middle level target scores for their security maturity, instead of aiming for a perfect score in every area at once. He closed with a useful shift in mindset. The goal is not to "become CRA compliant", the goal is to build secure products. Compliance then follows.

4. Activities During the Support Period, by Stijn Muylle (Cingulum)

Stijn Muylle gave a sober look at what happens after a product reaches the market. He focused on the support period that the CRA requires, which lasts at least 5 years.

His core message: under the CRA, engineering effort stays high after launch. The model starts to look much more like a continuous service than a one time build. Companies enter a steady cycle of Find, Fix, Document and Report, with hard deadlines such as a 14 day final report window for exploited vulnerabilities. Stijn also gave a clear budget warning. He estimated that this recurring support work could cost a company around 143,000 dollar, or roughly 119 person days, every single year. You can find his cost estimator and calculator at PracticalCRA.com.