Luca BertonIf your product contains both digital elements and AI capabilities — and an increasing number do — you face dual compliance obligations: the CRA for cybersecurity and the AI Act for AI-specific risks.
How They Overlap
- Risk assessment — Both require risk assessment, but from different angles (cyber risk vs. AI risk)
- Documentation — Both require technical documentation, with some overlap in scope
- Conformity assessment — Products may need separate assessments under each regulation
- Post-market monitoring — Both require ongoing monitoring and incident reporting
Unique AI Act Requirements
Beyond CRA cybersecurity requirements, the AI Act adds:
- Transparency obligations (users must know they're interacting with AI)
- Data governance (training data quality, representativeness)
- Human oversight mechanisms
- Bias monitoring and mitigation
- AI risk classification (Unacceptable, High, Limited, Minimal)
Kubernetes Recipes
A practical guide for container orchestration and deployment by Grzegorz Stencel & Luca Berton (Apress).
Watch on Skillshare →Building a Unified Compliance Program
Don't create separate compliance programs. Build one product governance framework that addresses both:
- Unified risk assessment that covers cyber and AI risks
- Shared technical documentation structure
- Combined testing methodology (security + AI performance)
- Single vulnerability and incident management process
- Coordinated conformity assessment planning
Platform Engineering Connection
This is where AI platform engineering becomes a compliance enabler. A well-architected platform embeds CRA security controls and AI Act governance into the development pipeline — making compliance a default, not an afterthought.
Back-End Infrastructure: Servers, Secure APIs and Data
Build secure back-end infrastructure from the ground up. In collaboration with Starweaver.
Start on Coursera →