24/7 incident response · +34 902 540 891

Manufacturers: the CRA determines who can sell in Europe

If your company manufactures equipment or software with digital elements, this is not about reducing risk: it is about market access. Without Cyber Resilience Act compliance there is no CE marking, and without CE marking there are no sales in the EU.

The rules have changed

The Cyber Resilience Act (EU Regulation 2024/2847) makes cybersecurity a product requirement, on the same level as electrical safety or electromagnetic compatibility. It affects almost any “product with digital elements” placed on the EU market: a PLC, drive, gateway, camera or the software supplied with them.

The dates are already set: obligations to report actively exploited vulnerabilities and severe incidents apply from September 2026, and the full regulation—essential requirements, conformity assessment and CE marking—from December 2027. A typical industrial development cycle lasts longer than that: the product you are designing today will reach the market with the CRA in force.

Industrial manufacturers also have a second language to master: customers already request IEC 62443-4-1 (secure development) and 62443-4-2 (component requirements) in tender specifications. The CRA and 62443 overlap considerably; addressing them together avoids paying twice for the same effort.

What we do for manufacturers
  • CRA gap analysis: what applies according to the product class, what is missing and which deadlines apply.
  • Implementation of a secure development lifecycle under IEC 62443-4-1: requirements, reviews and vulnerability management.
  • Technical product assessment against IEC 62443-4-2, with real testing in our Ti Lab laboratory.
  • Product penetration testing: firmware, communications, physical and management interfaces, following recognised guidance such as the OWASP ISTG.
  • Set-up of the vulnerability management and disclosure process (PSIRT) that the CRA requires throughout the product lifecycle.
  • Preparation of the technical documentation and file for conformity assessment.
Who we work with

With technical management, R&D and product teams. The conversation is not about threats and risks: it is about requirements, time to market and certification costs. If your product manager wants to know whether the company can continue selling in Europe in 2028, that is exactly the meeting to have.

Talk to us

Related

Technical detail, when you need it

Titanium · Legal information

Owner information and terms of use

Legal notice

Pursuant to Spanish Law 34/2002 of 11 July on information society services and electronic commerce, this website is owned by TITANIUM Industrial Security, S.L. (Spanish tax ID B75155903), with registered address at Paseo Mikeletegi 43, 20009 Donostia / San Sebastián, Gipuzkoa (Spain), telephone +34 902 540 891 and email info@titaniumindustrialsecurity.com, registered in the Gipuzkoa Commercial Registry, volume 2748.

The content of this website is for information purposes only and does not constitute a contractual offer. The trademarks mentioned belong to their respective owners. Reproduction of the content without permission is prohibited, except when quoted with attribution to the source.
Titanium · Legal information

What we do with your data

Privacy policy

Data controller. TITANIUM Industrial Security, S.L. (CIF B75155903), Paseo Mikeletegi 43, 20009 Donostia / San Sebastián.

What data we process and why. The information you enter in the form: first name, last name, email address, company, reason and enquiry description. We use it to reply and follow up on your request. The legal basis is your consent, which you may withdraw at any time. Zoho acts as the form technology provider and may receive the technical data required to process it.

What we do not do. We do not use your data for automated advertising, disclose it to third parties except where legally required, or make automated decisions about you.

Your rights. Access, rectification, erasure, objection, restriction and portability, by writing to info@titaniumindustrialsecurity.com. You may also lodge a complaint with the Spanish Data Protection Agency (aepd.es).
Titanium · Legal information

Tracking and storage

Cookies

A cookie is a small file that a website stores in your browser. This site uses its own cookies that are required for it to work and, only if you allow it, cookies for analytics, chat and visiting-company identification. No non-essential cookie is installed before you consent: the scripts that set them are not loaded until you accept their category.

On your first visit you will see a notice with three options of equal weight: accept all, reject all, or choose by category. Rejecting does not restrict access to any content. Your choice is stored for 12 months and you can change or withdraw it at any time through , in the footer of any page.

Necessary cookies

They are exempt from consent because without them the site cannot deliver the service you asked for.

CookieProviderPurposeDuration
ti_consentTitanium (first party)Stores which cookie categories you accepted or rejected, so we do not ask again.12 months
Zoho session cookiesZoho Corporation (crm.zoho.eu)On the form page only: they serve the CAPTCHA image and validate the submission against automated abuse. Their names are set by Zoho and may change.Session

Analytics cookies

They tell us which pages are read and where the form is abandoned, in aggregate. They require your consent.

CookieProviderPurposeDuration
_gaGoogle Analytics 4Distinguishes one browser from another in order to count visitors.2 years
_ga_<ID>Google Analytics 4Keeps the measurement session state.2 years
Form analyticsZoho Corporation (crm.zohopublic.eu)On the form page only: measures how many people open it and at which field they abandon it.Session

Functional cookies

They run the support chat, available on every page. If you reject them the chat does not appear and the site and the form still work.

CookieProviderPurposeDuration
_zldpZoho SalesIQIdentifies unique chat visitors.2 years
_zldtZoho SalesIQIdentifies each visit by the same visitor.1 day
_siqidZoho SalesIQRecognises the visitor across successive conversations.2 years
zld…state, zld…dragposZoho SalesIQRemember whether the chat window is open and where it was placed.5 minutes

B2B identification cookies

They require your consent. They are used to know which companies visit the site, not which individuals.

CookieProviderPurposeDuration
_lfaLeadfeeder / DealfrontBrowser identifier. Combined with the IP address it allows the visiting organisation to be inferred and later visits to be recognised.365 days
_lfa_test_cookie_storedLeadfeeder / DealfrontChecks whether the browser accepts cookies.1 second

Who processes the data, and where

The controller is TITANIUM Industrial Security, S.L. The providers act as processors: Zoho through its European infrastructure (crm.zoho.eu, salesiq.zoho.eu), and Google (Google Analytics 4) and Dealfront (Leadfeeder), which may involve international transfers relying on the safeguards set out in Chapter V of the GDPR. The IP addresses collected by these tools are personal data: you can exercise your rights and find more information in the privacy policy.

How to withdraw consent or delete cookies

You can change your decision at any time through . When you withdraw a category we stop loading its scripts and delete the cookies the site is able to delete. You can also remove and block them from your browser settings: Chrome, Firefox, Safari and Edge all allow this in their privacy section. If you do, the choices you saved here will disappear too and we will ask you again.