Cyber Resilience Act in Odoo: smart products compliance EU 2027 (guida PMI manifattura)

Settantaduesima guida operativa Odoo 19 per PMI italiane. Il Cyber Resilience Act (CRA, EU 2024/2847) entra in vigore dicembre 2027 e impone obblighi cybersecurity su tutti i “prodotti con elementi digitali” venduti in EU. Smart products manifatturati da PMI italiane (macchinari connessi, dispositivi IoT, soluzioni software embedded, prodotti smart) saranno coperti. Non compliance = no CE marking = no vendita in EU. Sanzioni fino 15M € o 2.5% fatturato. Le PMI manifatturiere che producono “smart product” devono iniziare a prepararsi adesso. In questa guida vediamo come affrontare CRA con Odoo 19.

Vediamo: scope CRA, le 3 categorie prodotti, requirements security by design, vulnerability management, post-market obligations, SBOM, casi pratici PMI manifatturiere.

Scope del CRA

Cosa è “prodotto con elementi digitali”

• Software product
• Hardware con software
• Connected devices
• IoT products
• Components separable digital elements

Esclusioni

• Open source non commercial
• Medical devices (MDR coverage)
• Motor vehicles (specific regulation)
• Aircraft (specific regulation)
• Defence products

Esempi PMI manifattura italiana

• Macchinario industriale con HMI/connectivity
• Smart appliances (elettrodomestici intelligenti)
• Dispositivi IoT industriali
• Sensori connessi (industrial sensors)
• Software embedded in prodotti hardware
• Robot industriali con AI

Le 3 categorie prodotti CRA

Default category

• Self-assessment conformity
• Maggior parte dei prodotti consumer + industrial
• CE marking + EU declaration

Important products class I

• Self-assessment OR third-party conformity
• Esempi: identity management systems, browsers, password managers, VPN, firewall, antivirus

Important products class II

• Third-party conformity assessment mandatory
• Esempi: OS, hypervisor, smart cards, smart meter gateways, robot industriali con cognitive features

Critical products

• European cybersecurity certification mandatory
• Hardware Security Modules, smartcard secure elements

Timeline applicazione

Dicembre 2027

• Full application requirements
• CE marking obbligatorio per prodotti CRA-scope

Settembre 2026

• Reporting actively exploited vulnerabilities
• Reporting severe incidents

Periodo transitorio

• Tempo per preparation
• Standardization in progress
• Guidance documents released

Product security by design

Ogni smart product manufactured deve dimostrare “security by design and by default”. Il product record in Odoo deve documentare design choices security, threat model, security features implemented, certificazioni applicabili:

• Security requirements specifications
• Threat model documentation
• Security features implemented
• Cryptography used + key management
• Authentication mechanisms
• Default secure configurations
• Update mechanism secure

Production con security integrated

Il MO per smart products deve integrare security check + provisioning sicuro durante manufacturing. La supply chain di security (chip, firmware, certificates) richiede tracciabilità completa:

• Secure provisioning steps
• Cryptographic keys management
• Default credential rotation
• Firmware version control
• Quality check security functions
• Audit trail provisioning

SBOM (Software Bill of Materials)

Il CRA richiede SBOM per ogni prodotto: lista completa software components + versions + licenses. La BOM in Odoo estesa con software components diventa il punto di documentazione SBOM:

• Software components identified
• Version specifico per componente
• License + restrictions
• Vulnerability tracking per component
• Standard format (SPDX, CycloneDX)
• Update process documented
• End-of-support dates

Vendor security requirements

Component vendors devono fornire informazioni security + SBOM. Il PO emesso deve includere security requirements + SBOM delivery, supply chain attack prevention è chiave per CRA compliance:

• Security requirements contract
• SBOM delivery obligation
• Vulnerability disclosure cooperation
• Security update commitment
• End-of-life notification
• Audit right cybersecurity

Post-market support obligations

CRA obbliga security support per “expected lifetime” del prodotto (minimum 5 anni). Sale order tracking + customer relationship in Odoo abilita la gestione lifecycle support sicurezza:

• Sold products linked to customer
• Update delivery mechanism
• Security notice channel
• End-of-support communication
• Vulnerability remediation timeline
• Customer support documented

Vulnerability handling obligations

Vulnerability disclosure policy

• Public contact point obbligatorio
• CVD (Coordinated Vulnerability Disclosure) process
• Acknowledgement researchers
• Communication clear

Reporting actively exploited vulnerabilities

• 24h: early warning to ENISA
• 72h: vulnerability notification
• 14 giorni: final report con corrective measures
• Coordination con CSIRT national

Severe incident reporting

• Definition: “significant impact” su availability/confidentiality/integrity
• Reporting timeline analogue
• Customer communication parallel
• Forensic analysis required

Essential cybersecurity requirements

Design + development

• No known exploitable vulnerabilities at release
• Secure default configuration
• Confidentiality + integrity protection
• Access control adequate
• Resilience to attacks

Vulnerability handling

• Public vulnerability disclosure process
• Security updates available throughout support period
• Documentation security features
• Transparency on incidents

Support period

• Minimum 5 anni (or product lifetime if shorter)
• Security updates free of charge
• Updates separate da feature updates
• Clear communication EOL

Conformity assessment options

Self-assessment (default + class I)

• Internal assessment per requirements
• Technical documentation
• EU declaration of conformity
• CE marking
• Cost: 8-35k € first product

Third-party assessment (class II + critical)

• Notified body involvement
• Technical file review
• Possibly factory audit
• Certificate issued
• Cost: 25-100k € first product

European cybersecurity certification

• Critical products only
• ENISA certification scheme
• Cost: 50-250k € + lengthy process

Costi tipici CRA compliance

Setup iniziale primo prodotto

• Threat modeling + security design: 15-50k €
• Security testing: 12-40k €
• Documentation: 8-25k €
• SBOM tooling + setup: 5-15k €
• Vulnerability management: 8-25k €
• Conformity assessment: 8-100k € (varia)
• Totale primo prodotto: 56-255k €

Prodotti successivi (economy of scale)

• Setup costo: -50/70% rispetto primo
• Reuse design patterns + tools
• Conformity assessment specific solamente

Ricorrente annuale

• Vulnerability monitoring: 15-40k €
• Security update delivery: 10-30k €
• Reporting + communication: 5-15k €
• Training + awareness: 5-15k €
• Totale: 35-100k €/anno

Errori comuni CRA prep

“Pensare ‘i nostri prodotti non sono digital'”

Problema: hardware con qualsiasi software/connectivity è scope.
Soluzione: legal review per scope assessment.

“Security come after-thought”

Problema: security tested at end, fundamental issues found late.
Soluzione: security by design, integrated dal product roadmap.

“SBOM ignored”

Problema: software components untracked, vulnerability response slow.
Soluzione: SBOM automation dal day 1, continuous monitoring.

“Support timeline non pianificato”

Problema: 5+ anni security support not budgeted.
Soluzione: lifecycle cost modeling includes long-term security support.

“Vendor sec requirements vaghi”

Problema: subcontractors deliver insecure components, prodotto finale impossibile certificare.
Soluzione: requirements specifici contratto + audit periodici.

Casi pratici PMI manifatturiere italiane

Caso 1 — Industrial machinery: smart controls

• Macchinario industriale con PLC + HMI + connectivity
• Classification: default category
• Self-assessment + technical doc
• Investimento: 145k € first product
• Cost subsequent products: 45k €

Caso 2 — Smart appliances: consumer product

• Elettrodomestico smart con WiFi
• Self-assessment
• OTA update mechanism
• 5 anni support commitment
• Investimento: 95k €

Caso 3 — Industrial IoT: gateway critical

• Smart meter gateway = important class II
• Third-party assessment
• Investimento: 180k €
• Customer enterprise contract: salvato 8M €

Caso 4 — IoT sensor: surprise scope

• Sensor “semplice” ma con connectivity
• Late discovery in scope CRA
• Recovery: 95k € + 6 mesi delay
• Lesson learned: scope assessment early

FAQ

I miei prodotti sono in scope CRA?

Check: prodotto include software o connectivity? Se sì, almost certainly scope. Verifica esclusioni (medical, vehicle, etc.). Legal opinion per certainty.

Quanto tempo serve per essere compliant?

Default category: 9-18 mesi per primo prodotto. Important class II: 12-24 mesi. Critical: 18-36 mesi. Subsequent prodotti faster.

Posso usare open source senza problemi?

Sì ma devi documentare in SBOM + monitor vulnerabilities + provide security updates. Open source “free” diventa responsibility tua per CRA purposes.

Cosa fare se vulnerability discovered post-launch?

Process: (1) verification; (2) report ENISA within 24h se actively exploited; (3) develop fix; (4) deliver update customers; (5) public disclosure coordinated.

CRA vs NIS2?

NIS2: cybersecurity di chi opera servizi essenziali. CRA: cybersecurity dei prodotti venduti. PMI può essere subject entrambi. Combined approach raccomandato.

Prossimi passi

Nelle prossime guide vedremo come preparare per Forced Labour Regulation EU, come integrare Data Act per data sharing requirements, e come gestire DSA/DMA impatti per PMI che operano marketplace.

Vuoi preparare CRA compliance Odoo nella tua PMI manifatturiera?
G Tech Group implementa programmi CRA compliance per PMI manifatturiere italiane: scope assessment, security by design, SBOM, vulnerability management, vendor requirements. Track record di PMI pronte before December 2027 deadline.
Richiedi un preventivo gratuito oppure prova la nostra demo Odoo 19 live. Oppure prova Odoo direttamente su odoo.com (link partner Brentasoft).