ENISA and the European Commission hold the conference "Product Cybersecurity: Making CRA a Reality" on Friday 11 December 2026, from 08:30 to 16:30 Brussels time, at The Square in Brussels and online. Registration is open on the ENISA event page.
Key takeaways
- The conference is on Friday 11 December 2026, three months after Article 14 reporting started to apply and one year before the CRA applies in full.
- ENISA and the European Commission co-organise it. The audience is manufacturers, SMEs, industry associations, policymakers, market surveillance authorities and security experts.
- The draft agenda has an opening keynote by Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy, and five panels.
- A separate deadline comes first. Comments on the ENISA draft advisory on security.txt, CVD policies and security advisories close on 15 November 2026.
Draft agenda
The draft agenda is marked "Version: Draft", so times and sessions can change.
| Time | Session |
|---|---|
| 08:30 | Registration |
| 09:15 | Welcome |
| 09:25 | Opening keynote |
| 09:45 | Talks on security by design and the CRA in practice |
| 10:30 | Panel 1, a manufacturer's journey through the CRA |
| 11:30 | Panel 2, the CRA Single Reporting Platform three months in |
| 13:30 | Panel 3, open-source software stewards |
| 14:00 | Panel 4, standardisation |
| 15:15 | Panel 5, Member States and conformity assessment infrastructure |
| 16:00 | Close |
The Commission announcement to the CRA Network lists four themes. These are progress towards CRA implementation, security by design in practice, emerging technologies and AI-supported compliance, and cooperation between industry, ENISA, the Commission and Member State authorities.
Why the date matters for manufacturers
Article 14 reporting started to apply on 11 September 2026, and the rest of the CRA applies from 11 December 2027. The conference sits between the two dates. Panel 2 reviews the first three months of the Single Reporting Platform. Panel 4 and Panel 5 cover harmonised standards and the conformity assessment bodies that Member States set up.
ENISA consultation closes on 15 November
ENISA published a draft Technical Advisory on security.txt, CVD Policies and Security Advisories on 26 October 2026. The 22-page draft gives manufacturers, in particular SMEs, templates for a security.txt file, a coordinated vulnerability disclosure policy and a security advisory. It links each template to the vulnerability handling requirements in Annex I Part II and to the Article 14 reporting obligation.
Send comments through the EUSurvey form by 15 November 2026. Porta Regulus B.V., the company behind CVD Portal, submitted its response on 26 October 2026.
Sources
- ENISA, Product Cybersecurity: Making CRA a Reality, event page and registration.
- ENISA, Product cybersecurity: Making CRA a reality, draft agenda, October 2026.
- ENISA, Technical Advisory on security.txt, CVD Policies and Security Advisories, public consultation draft, October 2026.
- European Commission CRA Team, update to the CRA Network, October 2026.
Generate an RFC 9116 security.txt file for your domains.
Open the free generator