iiThingAcademy
Regulation (EU) 2024/2847

The Cyber Resilience Act,
for people who ship firmware.

iThing Academy turns the CRA into a working course for embedded teams: 17 lessons you can read or watch, quizzes after every one, and an AI tutor that answers with article and annex citations.

See the course outline Ask the AI tutor
Lessons
17
Modules
5
Minutes
155
Abstract visualisation of a secured embedded circuit board
2024-11-20
Entered into force
2026-06-11
Notified body provisions apply
2026-09-11
Reporting obligations apply
2027-12-11
Full application

What the course covers

Secure by design

Annex I Part I translated into secure boot, signed updates, key storage and attack-surface work you can actually put in a sprint.

Built for embedded

Constrained flash, silicon-vendor BSPs, five-year support periods and field devices with flaky connectivity — not web-app advice.

Conformity routes

Self-assessment, Module B+C, Module H, technical documentation, harmonised standards and CE marking, explained end to end.

Reporting clocks

24 hours, 72 hours, 14 days. Who you notify, what you send, and the process to have ready before 11 September 2026.

Two tracks, one shared foundation

Everyone starts with Foundations — module 01 is free. After that, engineers go deep on implementation and compliance folks go deep on process and paperwork; both tracks are licensed per team. Request a quote.

Track

Engineering

Firmware, silicon and process work for embedded engineers.

Open trackTrack

Compliance

Assessment, documentation and reporting for product and compliance leads.

Open track

Start at lesson one

Full outline →
  1. 01What the CRA is and why it existsThe first horizontal cybersecurity law for products with digital elements, and the market failure it targets.
  2. 02Scope: products with digital elements and the risk classesWhat counts as a product with digital elements, what is carved out, and how important/critical classification changes your workload.
  3. 03Key dates and the transition timelineWhat is already binding, what lands in September 2026, and what December 2027 means for products in development today.
  4. 04Roles: manufacturer, importer, distributor, open-source stewardWho carries which duty in the supply chain, and how a role can change under your feet.
  5. 05Annex I Part I — the essential security requirementsA requirement-by-requirement walkthrough of what your product must actually do.