Login

u/Pitiful_Signature264

r/embedded r/IOT r/eutech r/CRACompliance r/europrivacy r/cybersecurity
▲ 10 r/CRACompliance+1 crossposts

Open-sourced our fact-checked CRA/RED/NIS2/CSA knowledge base - also works as a Claude Skill

We've spent the last few months building an internal reference on the EU's hardware/IoT security regulations (CRA, RED, NIS2, Cybersecurity Act/EUCC) for our own client work at Platanor - basically because re-reading four regulations side by side every time someone asks "does this even apply to us" got old fast.

Decided to open-source it. 25+ processed guides plus the primary source texts, fact-checked against EUR-Lex, structured so it's actually usable by humans and by LLMs - chunked by article, source-priority order, a verification date on every file. You can also install it directly as a Claude Skill if you'd rather have it load automatically than attach files by hand.
https://github.com/Platanor/hardware-compliance-handbook

u/Pitiful_Signature264 — 8 days ago
▲ 3 r/CRACompliance+1 crossposts

I was dealing with CE marking and this is what I understood

This month I was looking into the CE marking requirements under CRA, and one thing surprised me: I thought there was some kind of verification stage and that someone from the EU side was looking at what you did before you could put the mark. It turned out that for most products (those that don't fall into the "Important"/"Critical" categories) there is no such stage at all. You do the risk assessment yourself, write the documentation yourself, sign the declaration yourself, and that's it, no one checks it externally before release.

u/Pitiful_Signature264 — 12 days ago
▲ 3 r/eutech

Anthropic's AI security postmortem this week is a pretty good illustration of exactly the failure mode the EU's Cyber Resilience Act is trying to prevent

Anthropic published a postmortem this week: three cases where their AI models broke out of test environments into real company systems. Not through some clever exploit - a misconfiguration left an "isolated" environment with actual internet access, while the model was simply told it had none.

The EU's Cyber Resilience Act (vulnerability reporting obligations start next month, full application in December 2027) is built around almost the same principle, just for physical products: don't just document that something is supposed to be secure, actually enforce and prove it. One of the three Anthropic incidents happened through an exposed debug page - close to the exact class of flaw CRA targets in connected devices, an interface everyone assumed was locked down that nobody actually verified. We wrote about exactly this failure mode for embedded devices [here].

Feels like a pretty clean real-world case for why "we told it not to" isn't the same as it actually being unable to.

u/Pitiful_Signature264 — 20 days ago
▲ 10 r/IOT+1 crossposts

Anyone here dealing with EU CRA compliance for their connected devices? Tell me, how are things going for you?

I read several subreddits, some are just starting work on CRA compliance, some are already ready and want to hear how you're doing.

reddit.com
u/Pitiful_Signature264 — 22 days ago
▲ 9 r/embedded

looked at ~50 EU smart home products ahead of CRA deadline - almost all Tuya-based brands think they're covered. they're not

Been going through CRA compliance readiness across EU manufacturers lately. Looked at about 50 products - smart LED controllers, connected appliances, scales - mostly Polish and CEE brands.

Almost half of them run on Tuya. WB3S/CB3S modules, SmartLife app, the usual. And from what I can tell most of these companies assume Tuya handles their security obligations. Which is wrong in a pretty specific way. CRA defines the manufacturer as whoever places the product on the EU market under their name. Tuya is a component supplier. They secure the platform, sure. But the brand is still on the hook for their own VDP, their own SBOM (covering the Tuya SDK layer), and their own Article 14 reporting process. Tuya doesn't file that to ENISA for you.

The other big chunk was OEM hardware from Asian ODMs - generic BLE stacks, no Tuya. Most of these brands don't have firmware source code from their supplier at all. Hard to build a SBOM from a binary. Secure boot was basically nowhere in either group. WB3S/CB3S support it in hardware but it's off by default. Almost nobody had it enabled in production builds.

Anyone working on CRA compliance for embedded products? What's taking the most time?

reddit.com
u/Pitiful_Signature264 — 2 months ago
▲ 25 r/europrivacy

September 11 is when EU manufacturers become legally required to disclose vulnerabilities in your devices. Most of them aren't ready.

Article 14 of the Cyber Resilience Act kicks in 84 days from now. Any company selling connected products in the EU - routers, cameras, smart home stuff, wearables - has to report actively exploited vulnerabilities to ENISA within 24 hours. Then a detailed report within 72. Then a final one within 14 days.

Right now there's zero legal obligation to tell anyone about a vulnerability in your device. A company can sit on it for months, patch it quietly, or just... not patch it. That changes in September.

What surprised me when I looked into this: it's retroactive. That thermostat you bought three years ago? The manufacturer is on the hook for vulnerability reporting starting September 11 regardless of when it was released. No grandfather clause.

Enforcement is the obvious unknown here - 27 member states, 27 different market surveillance authorities. But the obligation is legally binding from day one regardless of whether anyone gets fined early on.

reddit.com
u/Pitiful_Signature264 — 2 months ago
▲ 11 r/embedded

How is your team actually handling CRA compliance? Looking for honest takes.

We're working on BLE-connected devices and CRA has been a constant background stressor( Engineering side feels manageable, but the process side - vulnerability disclosure workflow, SBOM maintenance, documentation - feels like it keeps getting pushed. Curious how others are approaching this. Are you doing it in-house, or working with a partner?

reddit.com
u/Pitiful_Signature264 — 2 months ago
▲ 3 r/europrivacy

CRA compliance is an engineering problem that nobody can solve without management buy-in - and most companies are stuck there

Been talking to a lot of people working on CRA compliance across EU manufacturers. The pattern I keep seeing isn't "we don't know what to do technically." It's something more frustrating: the engineers understand the problem, management doesn't prioritize it, and nothing moves.

The technical requirements are actually clear enough. Unique device identity, signed firmware, SBOM, vulnerability disclosure process. Hard to implement from scratch, but not mysterious.

The real blocker is organizational. Someone on the engineering side has been raising this internally for months. Compliance manager isn't engaged. Product roadmap doesn't have a slot for it. Budget hasn't been allocated.

And the clock doesn't care. September 2026 - Article 14 mandatory vulnerability reporting - is three months away and applies to products already shipping.

The argument that tends to actually move the conversation: stop framing it as a security investment and start framing it as market access. After December 2027, a product without CRA compliance cannot legally be placed on the EU market. That's not a security risk - that's a revenue risk. €15M fine or 2.5% of global turnover is a number a CFO understands.

Has anyone here actually managed to get internal alignment on this? Curious what finally moved it.

reddit.com
u/Pitiful_Signature264 — 2 months ago
▲ 7 r/embedded

The CRA 24-hour rule nobody is talking about

Most people building connected devices for the EU are focused on December 2027.

There's a deadline in 3 months that matters more right now.

September 11, 2026 - mandatory vulnerability reporting kicks in. If an actively exploited vulnerability is found in your product, you have 24 hours to notify the EU authorities. Not to fix it. To file a report.

This applies to devices already on the market. Not future products.

The catch: to hit that window you need post-release component monitoring, an internal escalation process, and an accurate SBOM - all built and running before the incident happens.

Full breakdown of what CRA actually requires: https://www.platanor.com/blog/cyber-resilience-act

Anyone here already dealing with this? How are you tracking CVEs in shipped firmware post-release?

reddit.com
u/Pitiful_Signature264 — 3 months ago