At the 20th ETSI Security Conference, CYBERSTAND.eu moderated a panel bringing together regulators, the European Standardisation Organisations (ESOs), ENISA, industry, SMEs and open source to assess what it will take to be compliant with the Cyber Resilience Act (CRA) by December 2027.
The 20th ETSI Security Conference 2026 took place from 19 to 22 October 2026 at ETSI headquarters in Sophia Antipolis, France.
On Thursday 22 October, Silvana Muscella, CEO of Trust-IT Services, the organisation coordinating CYBERSTAND.eu, moderated the panel D4-3, "EUSR CRA: Successes and Challenges of CRA Compliance". The session addressed how CRA compliance challenges can be overcome in the next 15 months.
The session brought together the main actors supporting CRA compliance: Luis Miguel Vega Fidalgo (DG CNECT, European Commission), Vassiliki Gogou (ENISA), Sandra Feliciano (Chair of the ETSI CYBER EUSR Working Group), Davide Pratone (Huawei, on behalf of ETSI STF 725), Sonia Compans (STMicroelectronics), George Sharkov (SBS / European DIGITAL SME Alliance) and Juan Rico (Eclipse Foundation).
Bringing these perspectives into one room made it possible to assess the progress across the whole compliance chain, from drafting standards to applying them, and to identify the gaps that still require joint action before December 2027.
CRA Standardisation to Date: Results, Successes and Stakeholder Perspectives
The topic, the development of CRA standards and their practical implementation, particularly by SMEs, sits at the core of the project’s objectives.
Therefore, CYBERSTAND.eu was well placed to bring its expertise and its connections with the standardisation and SME communities to the discussion.
The project funds European experts to contribute to the CRA standardisation activities and organises events to raise CRA awareness among SMEs. During the session, CYBERSTAND.eu presented some of the preliminary results ot achieved so far:
- 91 contributions funded, worth €1.26 million: 45 to ETSI TC CYBER and 38 to CEN-CENELEC JTC 13, 58% of them delivered by SMEs.
- 19 standards reviewed from an SME perspective and implementation guides funded for 17 harmonised standards.
- A cluster of 10 DIGITAL-funded projects offering 44 free CRA compliance tools.
- 10 workshops in 10 EU cities, reaching 2,200 participants, 50% of them from SMEs.
Each panellist shared their view of the current state of play from the perspective of their own community. Together, these perspectives showed that the main successes in developing CRA standards stemmed from the challenges of the process itself: a short timeline, many vertical standards and limited expert resources.
I would highlight the cooperation of the ESOs with ENISA and the European Commission in the context of the human factor: good, very intense cooperation, with constructive criticism feeding into the drafting of CRA standards at an intense pace.
- Vassiliki Gogou, ENISA
Each community responded to these challenges in its own way, and each response had a concrete impact.
For the standardisation community, the tight timeline led the ESOs to rethink their working methods and ETSI to open early drafts to public consultation, one of the first times this has happened and a further step towards a more open and transparent process, in which a wider range of stakeholders can shape standards before they are finalised.
For industry, European Commission funding for rapporteurs was decisive, bringing to the standardisation table experts that companies could not have provided full-time. As a result, the drafting effort could keep pace with the deadline.
For SMEs, the outcome is direct representation: more than half of the CYBER-EUSR rapporteurs come from SMEs, covering areas that larger industry players could not. Their practical proposals make the standards usable by the companies that will implement them.
For the open-source community, taking part in standardisation at ETSI meant working differently from its usual practice. Its participation helps ensure that the standards take account of how open-source components are developed and integrated across the supply chain.
Open source is an integral yet fundamentally decentralised component of the modern software supply chain. Effective regulatory due diligence cannot simply be transactional; it requires meaningful engagement, mutual respect for community governance, and active upstream collaboration.
- Juan Rico, Eclipse Foundation
Finally, dissemination carried these results beyond the standardisation drafting rooms. Through their EU Tour event format, CYBERSTAND.eu and STAN4CRA brought CRA awareness to local SME ecosystems across major EU cities, so that the companies expected to apply the standards know they exist and how to use them.
Next Steps Towards CRA Compliance: Trust, Collaboration and Timing
The session closed where it began, returning to the challenges and to what is needed to complete the last stretch of the compliance journey before December 2027. Silvana Muscella, the panel moderator, identified three elements: trust, collaboration and timing.
Trust. Many manufacturers are still working with draft standards, and uncertainty about the final text makes them hesitant to commit. As Muscella put it, a harmonised standard "seen in black and white" allows the community to move forward. In the coming months, the publication of harmonised standards will give organisations the confidence to settle on a compliance approach, while the feedback gathered through the ETSI public consultation should make the final texts easier to accept and apply.
Collaboration. The panel itself showed the value of bringing all stakeholders into one room: the Commission, ENISA, standardisers, industry, SMEs and open source each hold part of the answer. As standardisation enters its final phase, continued dialogue will help align the remaining requirements with implementation needs.
Timing. With the December 2027 deadline approaching, speed is essential, and the deadline forces every company to ask what they will do if they are not compliant. In the months ahead, this urgency should accelerate the finalisation of the standards and encourage companies to act now, by mapping the standards relevant to their products and building their product inventory.