Virtual round table — The Cyber Resilience Act: Practical Implications for Supply Chains
2026-06-24 16:00 - 17:00 (Europe/Helsinki)
CyAN is co-hosting a virtual round table on the EU Cyber Resilience Act — The Cyber Resilience Act: Practical Implications for Supply Chains — on Wednesday 24 June 2026, in collaboration with the SCCS Summit Network and 1CxO CSA. The session continues a discussion our panelists began at the SCCS Summit in Munich (22–24 April 2026).

Registration: https://sccybersecurity.com/sccs-summit-network/

The CRA is no longer theoretical — it’s operational. From September 2026, companies placing digital products on the EU market must report actively exploited vulnerabilities and serious incidents within 24 hours, with full conformity and CE marking following in December 2027. And it doesn’t stop at the manufacturer’s door — importers, distributors, and even open-source stewards are pulled into the compliance chain. Cyber risk now travels with the product, and with everyone who touches it.

Event details

What: Virtual round table – The Cyber Resilience Act: Practical Implications for Supply Chains

When: Wednesday 24 June 2026, 16:00–17:00 CEST

Where: Online

Format: Fireside chat between experts, followed by Q&A and open discussion

Register: Reserve your spot via the SCCS Summit Network (or on LinkedIn at https://www.linkedin.com/events/virtualrt-cyberresilienceact-pr7467889827372351488/)

Panel

Tereza Jášková – Managing Director & Senior Legal Counsel, Alpiq

Rolf A. Becker – Co-Chair, Cloud Security Alliance (Swiss Chapter)

John Salomon (moderator) – Board member, Cybersecurity Advisors Network (CyAN)

A legal and enterprise perspective from a major energy group, and a cloud and ecosystem perspective drawn from years of multi-tier supplier governance — with room throughout for audience questions and discussion.

A big thanks to Bharat Raigangar of 1CxOCSA for helping to organise and facilitate this conversation!

The CRA in brief

The Cyber Resilience Act — Regulation (EU) 2024/2847 — is the first EU-wide law to set baseline cybersecurity requirements for “products with digital elements,” covering nearly all hardware and software placed on the EU market. Unlike NIS2, it regulates the products themselves, across their whole lifecycle. As a regulation rather than a directive, it is directly applicable in all member states, with no national transposition.

In practice, the CRA requires manufacturers to:

design and build products that are secure by default, with no *known exploitable* vulnerabilities at the time of release, meeting the Act’s risk-based essential requirements;

handle vulnerabilities across the product’s lifecycle and provide free security updates for a defined support period (a minimum of five years, unless the product’s expected use is shorter);

maintain a software bill of materials (SBOM) and apply the CE marking as proof of conformity;

report actively exploited vulnerabilities and severe incidents to ENISA’s Single Reporting Platform.

Crucially, the obligations don’t stop at the manufacturer. Importers, distributors, and even certain open-source software stewards are pulled into the framework. Most products can be self-assessed; “important” and “critical” categories face stricter conformity assessment. Penalties run up to €15 million or 2.5% of global annual turnover, the Act applies extraterritorially, and there is targeted relief for open-source stewards and SMEs.

Why it matters for the supply chain

Accountability sits with the manufacturer, but the evidence — SBOMs, vulnerability data, control assurance — is scattered across every supplier and sub-processor.

Meeting the CRA’s tight reporting timelines (a 24-hour early warning from the moment you become aware of an actively exploited vulnerability or severe incident) depends on visibility that reaches well below your Tier-1 suppliers, into cloud services and nth-tier subcontractors. SBOMs are now a legal requirement — yet many remain static documents that fall apart the moment they are needed during a live incident.

For third-party risk teams, the CRA reshapes due diligence, contracts, and continuous monitoring, and it lands hardest on the long tail of smaller suppliers. It is, at once, a supply-chain problem, a product-design problem, and a governance problem.

Implementation timeline

DateMilestone10 December 2024CRA enters into force11 June 2026Provisions on conformity assessment bodies (notified bodies) apply11 September 2026Reporting obligations apply — manufacturers must report actively exploited vulnerabilities and severe incidents11 December 2027Main obligations, conformity assessment, and CE marking apply in full

*Watch item:* the proposed Digital Omnibus (19 November 2025) would introduce a single EU entry point for incident reporting and adjust early-reporting timing. It is not yet law.

EU information resources

CRA text — Regulation (EU) 2024/2847 (EUR-Lex): https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng

European Commission — Cyber Resilience Act policy page: https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act

European Commission — Summary of the legislative text: https://digital-strategy.ec.europa.eu/en/policies/cra-summary

European Commission — Reporting obligations: https://digital-strategy.ec.europa.eu/en/policies/cra-reporting

ENISA — Single Reporting Platform (SRP): https://www.enisa.europa.eu/topics/product-security-and-certification/single-reporting-platform-srp

About the collaboration

CyAN (Cybersecurity Advisors Network) is a global, not-for-profit association of cybersecurity professionals working across policy, governance, and international cooperation. More at https://cybersecurityadvisors.network/

The SCCS Summit Network is the year-round community of the Third Party & Supply Chain Cyber Security (SCCS) Summit — a long-running EMEA forum for information security, cyber TPRM, and GRC professionals. More at https://sccybersecurity.com/sccs-summit-network/

This round table is intended as orientation and practitioner perspective on the CRA. It is not legal advice; organisations should seek qualified counsel on their specific obligations.

GITEX AI - Berlin 2026
2026-06-30 00:00 - 2026-07-01 23:59
GITEX AI EUROPE returns to Berlin from 30 June to 1 July

Berlin – GITEX AI EUROPE, the most international technology and digital investment cross-industry event in Europe, is back to Germany, from 30 June to 1 July 2026, at Messe Berlin.

As Europe’s definitive platform for sovereign digital transformation, GITEX AI EUROPE unites enterprises, SMEs and startups with investors, policymakers and researchers to accelerate new business, new capital and new partnerships.

GITEX AI Europe 2026 – CyAN Ecosystem Partner
2026-06-30 08:00 - 2026-07-01 17:00
CyAN has been confirmed as an Ecosystem Partner of GITEX AI Europe, taking place 30 June to 1 July 2026 in Berlin, Germany.

The partnership positions the Cybersecurity Advisors Network (CyAN) alongside global leaders in artificial intelligence, deep tech, policy, and enterprise innovation as Europe advances into its next AI era.

Recognized for bringing elite cybersecurity expertise and real world resilience, CyAN’s involvement reinforces the importance of trust, governance, and secure digital transformation at scale.

The collaboration highlights a shared commitment to strengthening cyber resilience across the global AI ecosystem.

What Makes GITEX Europe Unmissable

Networking with VisionariesJoin the largest global tech community. GITEX unites big tech, startups, and SMEs from across Europe and beyond, forging powerful relationships that unlock collaborative opportunities and spark innovation.

Tech Transfer and Industry CrossoverExperience the ultimate technology convergence. GITEX Europe enables cross sector technology applications and attracts CTOs and CIOs looking to build optimal technology stacks for their industries.

Europe’s Digital Ecosystem in ActionMore than an exhibition, GITEX Europe mirrors the pulse of Europe’s digital transformation. Governments, startups, academia and investors come together to shape the continent’s technology future.

Content that Fuels GrowthSessions cover artificial intelligence, deep tech, sustainability, cybersecurity and more, helping organizations navigate Europe’s digital complexities and uncover new opportunities.

Government Driven TransformationWith backing from the European Commission and participation from national digital agencies, GITEX Europe fosters critical discussions on topics such as data sovereignty, cloud infrastructure and AI regulation.

Tickets

Registration for GITEX AI Europe 2026 is now open.

🎟️ Secure your pass here:https://visit.gitexeurope.com/?utm_source=linkedin&utm_medium=social&utm_campaign=20260212-gitexeurope26-all-linkedin-reg-post

Early registration discounts may apply, so attendees are encouraged to register early to secure their place at one of Europe’s leading AI and deep technology events.

GISEC GLOBAL 2026 - Updated Dates
2026-09-16 08:00 - 2026-09-18 17:00
GISEC GLOBAL 2026 – The Middle East & Africa’s Largest Cybersecurity Event📅 16-18 September 2026 |

📍 Dubai Exhibition Centre (DEC), Expo City, Dubai

GISEC GLOBAL is the most influential and the largest cybersecurity gathering in the Middle East & Africa, uniting global CISOs, government leaders, technology buyers, and ethical hackers for three power-packed days of innovation, strategy, and live cyber drills.

In 2026, GISEC GLOBAL takes center stage at the iconic Dubai Exhibition Centre (DEC), Expo City, bringing together 25,000+ infosec professionals from 180+ countries on a world-class platform to discover cutting-edge technologies, forge high-value partnerships, and gain insights from the visionaries shaping the future of cybersecurity.

Get involved today

📌 Book Your Space

💫 Book Your Pod

✔ Pre-Register as Visitor

For more information, visit gisec.ae

Trust & Safety Festival Sydney 2026 (8 & 9 Oct)
2026-10-08 12:00 | Pullman Sydney Hyde Park, 36 College Street, Darlinghurst, NSW, 2010, Australia
📅 Thu, 8 Oct, 8am – Fri, 9 Oct, 5pm AEDT

📍 Pullman Sydney Hyde Park, Darlinghurst NSW, Australia

Trust & Safety Festival Sydney 2026 brings together the people shaping safer, more accountable and more trustworthy digital systems.

CyAN is proud to be a key partner of the inaugural Trust & Safety Festival Sydney, taking place at the Pullman Sydney Hyde Park on 8–9 October 2026, following a Welcome Reception hosted by Corrs Chambers Westgarth on 7 October.

The Festival will bring together policymakers, regulators, technologists, researchers, lawyers, civil society leaders and frontline practitioners working across online safety, AI governance, cybersecurity, privacy, human rights, child protection, digital rights and platform accountability. Through keynotes, panels, workshops and practical discussions, participants will explore how policy, technology and safety-by-design can translate into meaningful real-world impact.

CyAN members, particularly those across Australia and the wider Asia-Pacific region, are warmly encouraged to attend.

Learn more, explore the programme and register your interest:

https://events.humanitix.com/trust-and-safety-festival-sydney-2026
