Preparing for the EU Cyber Resilience Act: A new era for product cyber security

The EU Cyber Resilience Act (CRA) is here — and it’s going to change how we build, sell, and maintain digital products in Europe. With new rules around product cybersecurity, vulnerability reporting, and compliance documentation, companies now have a clear deadline: get ready by 2027. This session will cut through the noise and give you a practical look at what the CRA actually requires, what’s changed over the past year, and where the biggest challenges (and a few headaches) are likely to show up. If you make, import, or sell connected products, software, or hardware in the EU, this session is for you. Speaker bio: Luka Ivezic is an Advisory Services Lead for Cybersecurity Regulations & Emerging Technologies at the Information Security Forum (ISF). With a deep background in cybersecurity strategy, critical infrastructure protection, and regulatory compliance, Luka helps organisations navigate the complex intersection of technology, business, and regulation. In his role at ISF and through years advising both public and private sector clients, Luka has been closely involved in tracking and interpreting the EU Cyber Resilience Act (CRA) from its early drafts through its finalization. His practical, real-world approach helps companies understand not just what the CRA demands, but how to realistically prepare for compliance amid shifting standards and technical challenges. Luka brings a mix of regulatory insight, cybersecurity expertise, and business pragmatism to every conversation about product security in the digital age.