BLOG
What AI Act, CRA, NIS2 and IEC 62443 actually mean for the people who design and sell industrial products. Operational analysis from real projects — not regulatory summaries.
Most industrial manufacturers already have an ISO 9001 certified quality system. It's a real advantage on the CRA, but only if you know which mechanisms you can reuse and which you have to build from scratch. The honest map, with references to the CRA articles and the ISO 9001 clauses.
The Cyber Resilience Act doesn't start all at once. There are three dates that matter, 11 September 2026, 11 December 2027, and the end of the RED's cyber requirements, and for each a minimum state you must be able to demonstrate. The operational timeline, with references to the articles.
The Cyber Resilience Act is not a box to tick before CE marking: it's an obligation that follows the product for its whole life. What a product with digital elements is, the three obligations that didn't exist before, and how to turn their requirements into development decisions. With precise article references.
Put an AI model in an OT product and you get two risks in different languages. 62443 secures the box, 42001 the brain: how to integrate them, in six points.
IEEE, ISO/IEC 42001, EN 18286 and the SC 42 family of standards are not on the same plane. Confuse them and you certify the wrong thing. The three-level map, and how each standard hooks into the AI Act articles.
Many rank their AI use cases by expected return. It's the wrong criterion: what decides which one ships first is the AI Act risk classification and the maturity of the data. How a regulation becomes a product decision.
ISO 42001 grants no presumption of conformity with the AI Act — but for product builders its value is operational and available now. Why starting pays off.
45 free minutes to map your regulatory exposure and figure out what's urgent for your product.
Book the Regulatory Spark