Luca BertonEarly adopters of CRA compliance are 12-18 months into implementation. Their experiences reveal patterns that every organization can learn from. Here are the ten most impactful lessons.
Lesson 1: Classification Is Harder Than Expected
Products rarely fit neatly into one CRA category. A smart home hub might be Default category for its basic function, but Important Class I for its network management capabilities. Get expert help on classification — mistakes here cascade through the entire compliance program.
Lesson 2: SBOM Quality Matters More Than SBOM Existence
Generating an SBOM is easy. Generating a complete, accurate SBOM that includes transitive dependencies, build-time tools, and firmware components is hard. Invest in tooling that captures the full picture, not just direct dependencies.
Kubernetes Recipes
A practical guide for container orchestration and deployment by Grzegorz Stencel & Luca Berton (Apress).
Watch on Skillshare →Lesson 3: The Reporting Infrastructure Takes Longer Than the Reporting Policy
Writing a vulnerability disclosure policy: 2 weeks. Building the infrastructure to detect, triage, and report vulnerabilities within 24 hours: 3-6 months. Start with infrastructure, not documents.
Lesson 4: Open Source Is the Biggest Compliance Surface
70-90% of product code is open source. Most compliance effort goes into managing open-source components — tracking vulnerabilities, ensuring updates, maintaining SBOMs. Invest in software composition analysis first.
Terraform for Beginners
Master Terraform to build scalable infrastructure using IaC principles.
Start on Udemy →Lesson 5: Secure Defaults Break Backwards Compatibility
CRA requires "secure by default." Enforcing this on existing products breaks customer configurations. Plan for migration paths: provide secure defaults for new installations while offering documented opt-out for existing deployments.
Lesson 6: The 5-Year Support Period Changes Product Economics
Committing to 5 years of security updates changes the product P&L. Factor update infrastructure and team costs into product pricing from launch. Some low-margin products may no longer be viable.
AI Readiness Assessment
Fixed-fee, 3-4 week infrastructure and compliance audit with a concrete roadmap. No big-consultancy overhead.
See Scope & Pricing →Lesson 7: Notified Bodies Are Already Overbooked
For Important Class II and Critical products requiring third-party assessment, notified body capacity is limited. Engage early — waiting until 2027 may mean you can't get an assessment slot before the deadline.
Lesson 8: Cross-Team Coordination Is the Real Challenge
CRA compliance requires coordination between: product development, security, legal, operations, and customer support. The infrastructure platform provides the shared language and tooling. Without it, coordination fails at scale.
Lesson 9: The Harmonized Standards Are Worth Waiting For (but Don't Wait Idle)
ETSI harmonized standards provide a presumption of conformity for Class I products. But they're not all published yet. Build your infrastructure against CRA essential requirements now. Align with harmonized standards when they're available — the adjustment will be minimal.
Lesson 10: Build Infrastructure, Not Compliance Projects
The organizations seeing the best results treat CRA as a platform engineering challenge, not a compliance project. They build infrastructure that makes every product compliant by default. Those treating it as a one-time project are already facing compliance debt with their second product.