CRA Practitioner - a 3-day course, hosted by MUDT, for the product, engineering, security and compliance teams responsible for implementing the CRA. Understand your obligations, work through realistic product scenarios, and leave with clear priorities for your organisation.
First cohort: 7 - 9 Sep 2026, on-site in Munich. Further dates will follow. Led by product-security and compliance practitioners, including a member of the European CEN/CENELEC working group developing CRA standards.
The CRA's reporting obligations apply from 11 September 2026 and its essential requirements from 11 December 2027 (serious violations can attract fines of up to € 15 million or 2.5 % of global annual turnover). But the real work is operational: most organisations still need to establish ownership, product scope, vulnerability and reporting workflows, reporting evidence and secure-development practices. This course helps cross-functional teams decide what to build first.
The cross-functional roles that have to implement the CRA. It is relevant to anyone who touches a product that falls under the CRA, not just the security team - and no prior CRA knowledge is required. Best attended as a team - you leave with a shared vocabulary and an aligned view of who does what.
The people who teach are the people who do the work - and one of them helps write the standards you will have to meet.
Application Security Architect with more than 20 years in software development - full-stack, backend, DevOps and cloud - and fully focused on application security since 2016. He is a member of CEN/CLC/JTC 13/WG9, the European working group that develops the CRA standards.
LinkedIn profileSeasoned IT security expert and founder of blueheads GmbH, with over 25 years in IT architecture, secure software engineering and information security; certified ISO/IEC 27001 Lead Auditor and lecturer at MUDT.
LinkedIn profileEach day combines expert-led instruction with guided discussion and worked examples. Participants work through real CRA requirements and map them to realistic products - whether software, connected hardware or industrial systems, with practical rather than hypothetical scenarios. Because the course is designed for cross-functional groups, product, engineering, legal and security teams build a shared understanding of the law and what it means for their work. It ends with a structured action-planning session, so teams leave with concrete next steps rather than just notes.
The CRA at a glance - scope, classification, timeline, fines and effects on open source; notification obligations (active from 11 Sep 2026); Software & Hardware Bill of Materials and vulnerability management; reporting via the CRA Single Reporting Platform (to the relevant CSIRT, with information shared with ENISA), including the 24-hour, 72-hour and 14-day deadlines.
Architecture discovery and risk profiling; threat modelling in the CRA context; product and process security requirements; baseline maturity with OWASP SAMM; and the ENISA secure-by-design and secure-by-default principles.
CRA essential requirements deep dive and self-assessment; declaration of conformity, technical and user documentation, and long-term support duties; closing with an action-planning session on the roles and next steps for your organisation.
The course is hosted by MUDT (Munich University of Digital Technologies & Applied Sciences) at its Center for Cyber Security and AI, and taught by product-security and compliance practitioners. It is grounded in recognised frameworks - OWASP SAMM and the ENISA secure-by-design playbook - so the approach is structured and defensible. Participants receive a certificate of participation. This is professional training: MUDT acts as host; it is not an accredited or ECTS-bearing programme.
This first cohort (7 - 9 Sep 2026) runs fully on-site at MUDT on the Siemens Campus in Neuperlach, Munich. Further dates follow, and later cohorts can also be delivered fully remote.
You want to build your own CRA capability and join the next scheduled cohort.
Reserve a placeYou want several roles - product, engineering, security, compliance - aligned on the same understanding.
Request a team quoteYou want the course delivered for one organisation and mapped to your own products and stack.
Discuss an in-house courseNo - the course is designed for a mix of security, compliance, product and engineering roles.
The CRA covers products with digital elements placed on the EU market - software, connected hardware, industrial and embedded products, and SaaS where it ships software. The course includes a product-classification step, so you can work out which obligations apply to what you ship.
Yes - a certificate of participation. MUDT hosts the course; it is professional training, not an accredited or ECTS-bearing programme.
Yes - team places and in-house bookings for a single organisation are available on request.
The first cohort (7 - 9 Sep 2026) runs fully on-site in Munich. We run the course regularly, and later cohorts can be delivered fully remote - register your interest and we'll match you to a suitable date.
Further dates follow - including remote cohorts. Register your interest for a later date.
Tell us a little about you and we will come back within one working day.
The webinar explains what is changing. The three-day course helps your team turn those obligations into processes, product decisions and an implementation plan.