Back ZIUR analyses the practical impact of the CRA regulation across different industrial sectors in Bilbao

2026 / 05 / 26
ZIUReko zuzendari nagusi María Penillak Cyber Resilience Act araudiaren eragina eta industriak Europako zibersegurtasun-esparru berrira egokitzeko dituen erronkak aztertzera zuzendutako Tecnaliak eta Certinaliak antolatutako jardunaldi batean parte hartu du.

ZIUR analyses the practical impact of the CRA regulation across different industrial sectors in Bilbao

The general director of ZIUR María Penilla took part in an event organised by Tecnalia and Certinalia to analyse the impact of the Cyber Resilience Act and the challenges facing industry in adapting to the new European cybersecurity framework.

ZIUR participated in the conference “Cyber Resilience Act (CRA): European Regulation (EU) 2024/2847”, organised by Tecnalia and Certinalia, which brought together around one hundred professionals and organisations in Bilbao involved in the design, development, integration, manufacturing, certification and commercialisation of digital products. The aim of the event was to highlight the real impact that the cyber resilience regulation will have on industrial activity, enabling companies to anticipate requirements, adapt their processes and prepare for a regulatory framework that will transform the European digital market.

The full entry into force of the new regulation in December 2027 will mark a turning point for all products with digital elements marketed within the European Union. The regulation will require manufacturers, developers and integrators to incorporate cybersecurity from the design phase onwards, maintain active vulnerability management and ensure technical compliance throughout the entire product lifecycle.

María Penilla, Director General of the Industrial Cybersecurity Centre of Gipuzkoa, took part in the round table discussion “The application of CRA and IEC 62443 regulations across different industrial sectors” to share her perspective on the real challenges facing industry, the implementation of the Cyber Resilience Act and the evolution towards security-by-design approaches.

In this regard, the ZIUR expert analysed the industrial sectors most affected by the regulation and their current level of adaptation. She also shared an overview of the cybersecurity situation of Basque and Gipuzkoan companies, before presenting the preliminary results of the ZIUR Acceleration Project promoted by the Provincial Council of Gipuzkoa, which aims to help local companies adapt to the cyber resilience framework. “With our CRA acceleration project, we aim to support and evaluate the products of up to 80 companies, and we have already received 50 applications,” said María Penilla. “Our goal is to cover the entire CRA adaptation cycle, offering companies the necessary support beforehand to face this process with greater confidence,” she added.

In addition, she presented the grant programmes promoted by the Provincial Council of Gipuzkoa to strengthen the cybersecurity capabilities of Gipuzkoa’s industrial ecosystem.

Penilla was joined in the discussion by Imanol García, R&D Project Manager at Power Grid INGETEAM; Jon Arregui, cybersecurity expert at the AFM Cluster; and Guillermo Unamuno, head of the Smart & Cyber department at the SPRI Group. Together, they highlighted the need to strengthen the Basque network of industrial cybersecurity stakeholders and build a strong collaborative ecosystem capable of protecting the business fabric.

The event also featured the participation of Juan Pulpillo, legal compliance expert at the Industrial Cybersecurity Centre (CCI), who delivered a presentation focused on the practical translation of regulatory requirements into industrial environments and their connection with international standards such as IEC 62443.