IEN Europe: The EU Cyber Resilience Act will come into full effect in December 2027. There is just over a year to go until then. What are the most important steps on the path to compliance, and where should a company be today in order to face the deadline with a degree of confidence?
B. Günthner: Ultimately, the Cyber Resilience Act is not just a security project; it is a transformational project that will change the entire product development process. Many companies initially focus on individual technical requirements. However, in practice, it becomes apparent that the real challenge lies in rethinking processes, responsibilities, and the entire product lifecycle. In our view, companies should already have a clear overview of which of their products are affected by the CRA and which requirements they have yet to meet. Based on this, development processes must be adapted to 'secure-by-design' principles, vulnerability management must be implemented, and the groundwork for a comprehensive software bill of materials must be laid.
Update capability is also particularly important. The CRA requires not only the development of secure products, but also the ability to operate them securely over a period of at least five years and to respond to new threats. It is precisely here that many manufacturers face organisational and technical challenges. Companies wishing to approach the December 2027 deadline with confidence should already have defined a CRA roadmap, implemented initial measures and actively involved their suppliers in the process. Those who only begin implementation in 2027 will have hardly any time left to make the necessary organisational adjustments.
IEN Europe: Why is CRA Compliance so crucial and what are the main criteria to ensure it?
B. Günthner: For the first time, the CRA will make cybersecurity a mandatory product characteristic. From now on, it will no longer be enough to simply implement security functions. Manufacturers will need to demonstrate that they systematically ensure security throughout the entire product lifecycle. This is particularly important for companies, as compliance with the CRA will soon be a prerequisite for marketing many products in Europe. At the same time, customer expectations are rising. We are already seeing cybersecurity become an integral part of tenders and procurement processes.
In our view, the key prerequisites for compliance are a structured secure development process, complete transparency regarding the software components used, robust vulnerability management, and the ability to provide security updates throughout the intended lifecycle. The CRA thus transforms cybersecurity into an ongoing management task rather than a purely technical discipline.
IEN Europe: What can Kontron, as a hardware and software manufacturer, do to support customers in this complex environment?
B. Günthner: In our view, reducing complexity for the customer offers the greatest leverage. Many manufacturers are challenged by the need to implement new regulatory requirements, develop existing products further and drive innovation projects forward. That is why we are committed to a holistic 'CRA-ready' approach: a comprehensive ecosystem of hardware, software and services that considers key requirements from the outset.
This is based on robust and secure hardware platforms that already align with the technical component requirements of IEC 62443-4-2 up to Security Level 2. This means that cybersecurity is considered not only at the level of the operating system and customer application, but also during the selection, development and configuration of the underlying hardware platform.
This is the foundation upon which KontronGrid is built: our IoT device and fleet management application that enables the centralised management and secure operation of large device fleets. It enables edge devices distributed worldwide to be centrally registered, configured, monitored and managed throughout their entire lifecycle. Software and security updates, as well as native and container-based applications, can be rolled out in a controlled manner across entire device fleets. Encrypted remote connections are also available for operation, maintenance, servicing and fault analysis. This allows the security measures required by the Cyber Resilience Act to be implemented in a scalable and traceable way.
The KontronOS operating system enhances this infrastructure by providing key security features, including Secure Boot, secure update mechanisms, role-based access control, and containerisation. Together, these features provide customers with a technical foundation that already meets many CRA requirements. While the individual solutions work very well on their own, they are at their most powerful when working together: the hardware, KontronGrid, KontronOS and AI Shield are all seamlessly integrated.
We are also experiencing a significant increase in demand for consultancy and integration services. While many companies have excellent product expertise, they need help translating regulatory requirements into concrete development and operational processes. Using our CRA scoring system, we work with customers to assess their current status. In accompanying CRA workshops, we develop practical 'security-by-design' concepts and support the efficient integration of compliance requirements into existing development environments.
IEN Europe: At Hannover Messe 2026, a cyber-secure, scalable, pre-configured industrial hardware gateway solution was introduced. The partners in this collaboration are TeamViewer (software), Kontron (hardware and operating system) and Bechtle (service). Can we expect more developments like this in the near future?
https://www.ien.eu/article/teamviewer-germany-gmbh-automation-needs-secure-access-using-agentless-software-to-build-an-industrial-gateway-solution/
B. Günthner: We certainly expect so. The requirements of modern industrial environments are becoming increasingly complex. Issues such as cybersecurity, remote access, lifecycle management, compliance and cloud integration must now be considered as an integrated whole. The gateway project presented at Hannover Messe is a great example of how different areas of expertise can collaborate. While Kontron provides the hardware and operating system, TeamViewer contributes secure remote access technology and Bechtle contributes its service and integration expertise. This results in a pre-configured, end-to-end solution for customers that can be implemented much more quickly than a bespoke system.
We are generally observing a trend towards such ecosystems. Customers are increasingly expecting fully integrated solutions that consider security, management, operation and compliance from the outset. This approach will be especially important in the CRA environment, where regulatory requirements affect the entire product life cycle.
IEN Europe: Once the 'CRA-summit' has been reached successfully, how should digital product manufacturers position themselves to keep up with current requirements and also to prepare for future changes and further regulatory requirements?
B. Günthner: The CRA should not be viewed as an end goal, but rather as the starting point for a new generation of digital products. Companies that successfully implement the requirements are simultaneously laying the foundations for future regulatory developments. We believe that the focus will increasingly shift from ad hoc to continuous compliance. Issues such as vulnerability management, secure updates, lifecycle protection and security monitoring will become permanent aspects of product responsibility.
At the same time, new regulatory requirements are emerging. In addition to the CRA, we are observing developments relating to the NIS2 Directive, the AI Act, the Machinery Regulation (EU 2023/1230) and the EU Data Act, as well as other sector-specific requirements. Companies will therefore benefit from an integrated ecosystem comprising hardware, software, services, platforms and processes that can respond flexibly to new requirements. In the long term, cybersecurity will become a key quality indicator. Customers will expect security, transparency, and the capacity for updates to be standard features of a product.
IEN Europe: As an experienced manufacturer of hardware and software: Could you give our readers an educated guess as to how physical AI will change industrial production environments in the coming years?
B. Günthner: We are currently witnessing a development in which artificial intelligence is being integrated directly into machines, industrial processes and plants. Physical AI enables machines to actively interact with the physical world and support real-time decision-making by analysing data. High-performance edge platforms are becoming increasingly important in this context. Data must be processed where it is generated, whether that be in a machine, a production system or a vehicle. This reduces latency, meets data protection requirements more effectively and enables processes to be designed to be more autonomous.
We expect Physical AI to lead to significant advances, particularly in areas such as predictive maintenance, quality control, robotics, and autonomous production processes. However, as autonomy increases, so does the importance of cybersecurity. When AI systems are making operational decisions, it is crucial that companies can ensure the underlying data, models and software components are trustworthy. This is why issues such as cyber resilience, secure software updates and lifecycle management will become increasingly important in future.
