EU Digital Product Regulation

Articles in this series, ordered by most recent update.

The EU Machinery Regulation 2023/1230: From Machine Safety to Cyber-Physical Safety
How software, connectivity, cybersecurity, AI, remote access, and digital modification are changing machinery safety
cybersecurity
enterprise risk management
regulation and compliance
tutorial
πŸ‡¬πŸ‡§

A technical analysis of Regulation (EU) 2023/1230 and its transition from traditional machinery safety toward cyber-physical safety, with a focus on software integrity, malicious interference, connected control systems, substantial modification, IEC 62443, remote access, AI, the Cyber Resilience Act, NIS2, procurement, and FAT/SAT.

Antonio Montano
May 23, 2026
Modified Oct 3, 2026
Keywords Regulation (EU) 2023/1230, Machinery Regulation, machinery safety, cyber-physical safety, industrial cybersecurity, OT cybersecurity, operational technology, IEC 62443, EN 50742, IEC TS 63074, functional safety, ISO 12100, ISO 13849, IEC 62061, safety-related control systems, protection against corruption, malicious third-party attempts, software integrity, configuration integrity, remote access, privileged access, zones and conduits, machine control authority, safety PLC, PLC security, industrial automation, industrial control systems, substantial modification, digital modification, conformity assessment, CE marking, harmonised standards, essential health and safety requirements, EHSRs, FAT, SAT, commissioning, lifecycle assurance, change management, cybersecurity verification, Cyber Resilience Act, CRA, NIS2, AI Act, self-evolving machinery, machine learning safety functions
Audiences analyst, executive, policy-maker, practitioner, subject-matter-expert, technical specialist
Difficulty intermediate

VEX Standards from First Principles
From software inventories and SBOM evidence to defensible, product-specific vulnerability-exploitability decisions, interoperable VEX exchange, lifecycle governance, and Cyber Resilience Act compliance across CISA, CSAF, CycloneDX, SPDX, and OpenVEX
cybersecurity
regulation and compliance
software systems
tutorial
πŸ‡¬πŸ‡§

A technical tutorial on SBOMs and Vulnerability Exploitability eXchange that explains how software inventories become product-specific exploitability decisions, how VEX information is represented and exchanged across CISA, CSAF, CycloneDX, SPDX, and OpenVEX, and how trust, lifecycle management, automation, interoperability, and regulatory obligations under the EU Cyber Resilience Act shape their practical use.

Antonio Montano
Dec 3, 2022
Modified Aug 22, 2026
Keywords SBOM, VEX, Vulnerability Exploitability eXchange, CISA, CSAF, CycloneDX, SPDX, OpenVEX, CVE-2021-44228, Log4Shell, Cyber Resilience Act, CRA, vulnerability management, software supply chain
Audiences analyst, practitioner, subject-matter-expert, technical specialist
Difficulty intermediate

A CVE Is Not an Article 14 Report: What Actually Makes a Vulnerability Reportable?
How to distinguish identifiers, severity scores, exploitation signals, product evidence, and the CRA reporting threshold
cybersecurity
regulation and compliance
report
πŸ‡¬πŸ‡§

A practical guide to deciding when a CVE, supplier advisory, KEV entry, scanner result, or zero-day becomes a mandatory vulnerability report under Article 14 of the Cyber Resilience Act.

Antonio Montano
Aug 17, 2026
Modified Aug 17, 2026
Keywords  
Audiences analyst, practitioner, subject-matter-expert, technical specialist
Difficulty intermediate

Does the CRA Require Vulnerability Scanning from 11 September 2026? No, but It Does Require a Reporting Decision Process
What manufacturers must have ready for Article 14, what customers can legitimately expect, and how scanners, SBOMs, telemetry, and threat intelligence fit
cybersecurity
regulation and compliance
report
πŸ‡¬πŸ‡§

A practical guide to CRA Article 14 from 11 September 2026: why vulnerability scanning is not a standalone legal duty, how manufacturers assess and report qualifying events, what customers can expect, and how security tools support the process in IT and OT.

Antonio Montano
Aug 16, 2026
Modified Aug 16, 2026
Keywords  
Audiences analyst, subject-matter-expert, technical specialist
Difficulty intermediate

Cyber Resilience Act: The New Product-Security Baseline
Scope, legal roles, secure design, conformity, reporting, and lifecycle assurance across the digital-product supply chain
cybersecurity
regulation and compliance
tutorial
πŸ‡¬πŸ‡§

A technical and legal analysis of the EU Cyber Resilience Act, explaining product scope, economic-operator roles, essential cybersecurity requirements, conformity assessment, component dependencies, vulnerability reporting, transition, and practical assurance governance.

Antonio Montano
Aug 3, 2026
Modified Aug 9, 2026
Keywords Cyber Resilience Act, CRA, Regulation (EU) 2024/2847, products with digital elements, cybersecurity regulation, EU product law, product security, secure by design, secure by default, cybersecurity risk assessment, essential cybersecurity requirements, vulnerability management, vulnerability handling, security updates, support period, software bill of materials, SBOM, remote data-processing solutions, RDPS, conformity assessment, CE marking, EU declaration of conformity, notified bodies, harmonised standards, important products with digital elements, critical products with digital elements, manufacturer obligations, importer obligations, distributor obligations, system integrators, economic operators, product lifecycle security, component due diligence, software dependencies, free and open-source software, FOSS, open-source software stewards, substantial modification, Article 14 reporting, actively exploited vulnerabilities, severe security incidents, ENISA, Single Reporting Platform, market surveillance, administrative fines, product liability, CRA compliance, cybersecurity assurance, procurement assurance, lifecycle governance, technical documentation, continuing conformity
Audiences analyst, executive, policy-maker, practitioner, subject-matter-expert, technical specialist
Difficulty intermediate

The EU Digital Battery Passport: Who Is Affected, What Must Be Done, and When
A practical guide to product scope, organisational responsibilities, data obligations, and the February 2027 deadline
energy
regulation and compliance
tutorial
πŸ‡¬πŸ‡§

An evidence-based guide to the European Union’s digital battery passport, explaining which batteries and organisations are affected, what each participant must prepare, and when the principal obligations take effect.

Antonio Montano
Jul 18, 2026
Modified Jul 18, 2026
Keywords EU Digital Battery Passport, battery passport regulation, Regulation (EU) 2023/1542, digital product passport, Cyber Resilience Act, Regulation (EU) 2024/2847, battery compliance, electric vehicle batteries, EV battery passport, light means of transport batteries, LMT batteries, industrial batteries, battery lifecycle data, battery traceability, battery data governance, battery passport requirements, battery passport deadline, 18 February 2027, economic operators, battery manufacturers, battery importers, battery suppliers, battery management systems, battery state of health, battery state of charge, battery repurposing, battery remanufacturing, battery recycling, circular economy, battery due diligence, battery carbon footprint, recycled content, QR code compliance, DPP Registry, battery passport interoperability, battery passport cybersecurity, products with digital elements, CRA compliance, vulnerability management, cybersecurity risk assessment, software bill of materials, SBOM, battery data access rights, legitimate interest, battery passport service providers, EU battery regulation
Audiences analyst, executive, policy-maker, practitioner, subject-matter-expert, technical specialist
Difficulty intermediate
No matching items
Back to top