Cyber Resilience Act: What matters now

Wed, 25 November 2026 | 4:05 p.m. – 4:25 p.m. | Moises Lorenzo-Leon, HEITEC AG

With the CRAs coming into force, manufacturers of digital products face a new challenge: cyber security. How will the new regulation affect their current and future products?

Wed, 25 November 2026 | 4:25 p.m. – 4:45 p.m. | Wolfgang Straßer, @-yet GmbH 

This presentation demonstrates how machinery and plant manufacturers can implement these regulatory requirements in a practical, efficient and future-proof manner – from ‘security by design’ to CE conformity.

Tue, 24 November 2026 | 3:00 p.m. – 3:20 p.m. | Florian Vetter, EUCHNER GmbH + Co. KG 

Conversions, modernizations, and retrofits of machinery can have far-reaching legal implications. Learn when a modification is considered a substantial modification under the Machinery Regulation (MR) or the Cyber Resilience Act (CRA) and what requirements arise as a result.

Using practical examples, you will gain guidance on how to assess your planned modifications in a legally compliant manner and learn what to consider during implementation.

Wed, 25 November 2026 | 10:00 a.m. – 10:20 a.m. | Sophia Pötsch, secuvera GmbH 

The Cyber Resilience Act (CRA) raises an important question for many small and medium-sized enterprises: how can the new requirements be implemented in practice with reasonable effort and without relying heavily on external consulting services? For companies with a limited product portfolio in particular, the challenge is often not a lack of commitment, but rather the absence of a clear approach, suitable tools and a reliable assessment of their current level of compliance.

This presentation uses a CRA starter package as an example to demonstrate a structured approach to implementation. It introduces a concept that combines knowledge building, practical application, and independent continuation of the process. The approach ranges from foundational training and the execution of a sample cybersecurity risk assessment to a toolbox containing templates and resources that support ongoing implementation within the organization.

Following an individual implementation phase, the achieved level of readiness is evaluated through a readiness check. This helps identify and prioritize any remaining gaps. The presentation provides a practical roadmap for enabling organizations to gradually implement the requirements of the CRA largely on their own, while using external support only where it adds the greatest value.

Wed, 25 November 2026 | 10:40 a.m. – 11:00 a.m. | Alexander Schwemberger, BearingPoint 

In this presentation, you will gain an overview of how to address the requirements of the Cyber Resilience Act (CRA). We go beyond the regulatory text and draw on practical examples from a variety of industries. Using real-world use cases from our clients, we demonstrate how organizations are implementing compliance requirements, strengthening their cyber resilience and even turning regulatory obligations into business opportunities.

BearingPoint supports companies throughout their CRA journey, from initial readiness assessments to technical implementation. In addition to assessments and security risk analyses, we provide expertise in establishing Software Bill of Materials (SBOM) and Bill of Materials (BOM) processes, vulnerability management, secure development lifecycle practices and secure remote service access. This helps create the transparency, security and compliance required for CRA-compliant products and digital supply chains.

Wed, 25 November 2026 | 11:00 a.m. – 11:20 a.m. | Alexander Matheus, VDE Prüf- und Zertifizierungsinstitut GmbH

The Cyber Resilience Act (CRA) is an EU regulation that, for the first time, establishes binding cybersecurity requirements for nearly all connected products and software components. It applies to devices and systems that transmit data or are connected to a network—including IoT products, connected electrical appliances, embedded systems, industrial control systems, and software-based functions. This presentation will outline the current status of regulation and standardization. It will also highlight additional steps manufacturers can take to prepare for the upcoming requirements. Our expert will provide guidance on how to prepare products for upcoming testing and certificatio procedures.

Wed, 25 November 2026 | 11:20 a.m. – 11:40 a.m. Stefano Floridan, UL Solutions 

The EU Cyber Resilience Act (CRA) is transforming cybersecurity from a best practice into a legal requirement for connected products entering the European market. This session will examine the key obligations introduced by the CRA, including secure development practices, vulnerability management, and conformity assessment requirements. Participants will learn how organizations can prepare for compliance, reduce regulatory risk, and leverage independent testing and certification to strengthen product security and market access. The presentation will also explore the role of CRA Notified Bodies in supporting conformity assessment activities for applicable product categories, helping manufacturers navigate regulatory requirements and demonstrate compliance with confidence. Attendees will gain practical insight into how early engagement with testing, certification, and Notified Body services can streamline market access and reduce compliance risks throughout the product lifecycle.

Wed, 25 November 2026 | 12:00 p.m. – 12:20 p.m. | Denis Göllner, Lenze SE 

Many machine builders are aware of the Cyber Resilience Act (CRA), yet numerous practical questions remain: Where should they start? Which requirements are critical? And how can greater cybersecurity be achieved without unnecessarily complicating development, commissioning and service?

This presentation provides a concise overview of the key challenges on the path to CRA compliance and highlights the support manufacturers should expect from their suppliers today. The focus is on easy-to-implement security features, flexible security concepts and transparency regarding product roadmaps and availability.

Practical, easy to understand and tailored to the realities of the machinery and equipment manufacturing industry, this session is designed for anyone looking not only to meet cybersecurity requirements, but to implement them efficiently.

Wed, 25 November 2026 | 3:00 p.m. – 3:20 p.m. | Stefan Turi, Rockwell Automation 

With increasing regulatory requirements, machine builders need more than just regular scans and manual follow-up. Real-time transparency, continuous monitoring and scalable processes across the entire installed machine base are becoming essential.

Machine builders must now ensure cybersecurity not only at the time of delivery, but throughout the entire lifecycle of a machine. 

In this session, you will learn how to understand the requirements of the Cyber Resilience Act (CRA), identify the most critical areas for action and security gaps and translate compliance requirements into concrete measures using a practical roadmap based on IEC 62443. The presentation also demonstrates how SecureOT can help create transparency, reduce risks and efficiently manage cybersecurity across large machine fleets. In addition, it explores how cybersecurity can be leveraged as a business opportunity to develop new service offerings and strengthen customer trust over the long term.