On 27 July 2026 the European Commission adopted its final guidance on the Cyber Resilience Act (CRA), clarifying scope, substantial modification, spare parts, support periods and reporting obligations. But the guidance is non-binding, several grey areas remain open, and the clock hasn’t stopped: mandatory reporting obligations start on 11 September 2026 — from that date, actively exploited vulnerabilities must be reported to authorities within 24 hours. Full compliance is due on 11 December 2027. Non-compliance risks fines of up to €15 million or exclusion from the EU market.

For local entrepreneurs, manufacturers, importers, distributors, System Integrators, ISVs and Solution Providers across Cagliari, the priorities are concrete: establish your legal role (you may hold more than one), classify your products against the CRA risk categories, and understand what the final guidance actually changed versus what was already law.

Join this exclusive event for entrepreneurs and decision-makers based in Cagliari to walk through what’s genuinely new, what grey areas remain, and the steps to take before the September deadline — including how SMEs can access EU funding (up to €30,000 through the SECURE project) to cover assessment and training costs.