The CRA deadlines are getting closer. Those who act now stay ahead.

The Cyber Resilience Act applies to every company that places products with digital elements on the EU market. This two-day training turns that challenge into a concrete plan. We don’t stop at explaining the law — we build the implementation itself: scope, classification, SBOM, reporting obligations and documentation, for your own products.

Delivered by a cyber lawyer and a product security expert, together. With exam and certificate. You leave with a defensible action plan you can put to use right away.

Two days
legal + technical
exam + certificate
max. 20 participants

Information session

September 8, 17h00 (CEST) | Online information session

Get to know the instructors, discover the training’s approach, and gain a clear picture of what you’ll concretely take back to your practice. Ask your questions directly and find out whether the CRA Lead Implementer training fits your role and ambitions.

Why take this training

What you’ll get out of it:

Decide with confidence. Know which products fall within scope, which class they’re in, and what you need to do.
Be ready for the reporting obligation. No panic at the first incident.
Speak one language. Legal and technical, so that legal teams, engineering and management understand each other.
Prove it. Documentation that withstands an inspection by the CCB or the FPS Economy.
Turn it into an edge. Answer customer questionnaires with confidence, or build out a CRA service line as an advisor.

Target audience

This is for you if you have to put the CRA into practice.

You lead the CRA effort internally (CISO, product security, compliance, legal, quality or product management) at a manufacturer, importer or distributor.
Or you advise clients as a consultant or lawyer and want to build out a CRA service line.

No prior knowledge required. Feel free to bring along a colleague from another discipline: the legal + technical tandem is the strength of this training.

Learning objectives

After these two days, you’ll be able to:

determine whether and how the CRA applies to your products;

classify your products and choose the right conformity assessment procedure;

translate Annex I into a concrete to-do list (secure design, secure updates, SBOM);

set up a vulnerability reporting process that meets the deadlines;

build the required technical documentation and EU declaration of conformity;

present a defensible roadmap to your management.

Teaching approach

Two experts, live. A lawyer and a practitioner. Legal question, technical answer, and vice versa.
Practice-oriented. Work on real products and bring your own product list: you’ll classify it on day one.
Small group. Maximum 20 participants, with room for your situation.
Complete package. Preparatory material in advance, a printed syllabus, and digital tools and templates.

End result

A certificate that means something.

You sit an exam and, upon passing, receive the “CRA Lead Implementer” certificate — a guarantee of knowledge, not an attendance certificate, that you can show in quotes and tenders. And it stays current: you get access to annual update sessions, so your certificate grows along with new standards and regulations.

How to prepare

No prior knowledge required. Want a head start anyway? Read through the text of the CRA (Regulation (EU) 2024/2847) and the European Commission’s FAQ beforehand. Before the start, we’ll send you targeted preparatory material and a short intake quiz.

The instructors

Maxim Baele

Maxim Baele is a product security expert at Toreon and chapter leader of OWASP Belgium. Ten years of experience in secure-by-design. Helps companies get CRA-ready on a daily basis.

Pedro Demolder

Pedro Demolder is an IP/IT and data protection lawyer at Timelex and guest lecturer on the legal aspects of cybersecurity at the Brussels Study Center and VIVES University of Applied Sciences.

CRA Lead Implementer