1. EU Cyber Resilience Act - ENISA Publishes Free SME Cyber Resilience Maturity Assessment Model
On 13 July 2026, within this briefing’s coverage week, ENISA published a free SME Cyber Resilience Maturity Assessment Model - a self-scoring tool letting micro, small, and medium-sized manufacturers benchmark their readiness for the Cyber Resilience Act. This is a distinct work item from the CRA Single Reporting Platform (SRP) and the secure-update-mechanism advisory covered in prior briefings; it targets organizational readiness rather than a specific technical or reporting obligation.
Structure: Organizations self-score across five domains - governance and documentation; risk management and security by design/by default; vulnerability management; product lifecycle management; and cybersecurity skills - on a 1-5 maturity scale that rolls up into an overall basic, intermediate, or advanced profile. ENISA delivered the tool as a downloadable, self-scoring spreadsheet meant to be reused periodically.
Context: The model follows ENISA’s 24 June 2026 SME CRA Survey Report, which found that most SMEs are aware the CRA exists but few have converted that awareness into practical readiness. Incident response and product lifecycle management scored as the weakest capability areas, with medium-sized firms consistently outperforming micro-enterprises.
Important caveat: ENISA is explicit that a higher maturity score does not substitute for CRA conformity assessment or certification - the model is a diagnostic, not a compliance determination.
Reporting platform status unchanged: Separately, ENISA’s Single Reporting Platform (SRP) - the mandatory Article 14 vulnerability and incident reporting portal - remained not yet live as of this week, with the 11 September 2026 mandatory reporting deadline now 54 days away. No additional SRP onboarding or registration materials beyond the maturity model were identified this week.
Manufacturer relevance: Medical devices under MDR/IVDR remain formally exempt from CRA product requirements, but manufacturers with connected accessories, companion apps, or standalone software components that fall within CRA scope should use the maturity model as a practical internal gap-analysis tool ahead of the September reporting deadline, particularly for smaller manufacturers and suppliers that have not yet run a formal CRA readiness assessment.
Source: On 13 July 2026, ENISA Published a Free Maturity Model So SMEs Can Score Their CRA Readiness - cyberresilienceact.eu
Disclaimer: This briefing is prepared by Aktriva for informational purposes only and does not constitute legal, regulatory, or compliance advice. Information is drawn from publicly available sources; while we aim for accuracy, errors or omissions may occur despite our review process. Readers should independently verify developments against primary regulatory sources and consult qualified advisors before making compliance decisions.
Want this tailored to your regulatory strategy?
Talk to our team about what this week's developments mean for your specific device and timeline.