With significant milestones behind us, the CONFIRMATE project is now entering its final phase. Over the past months, we have built, refined, and aligned our open-source tooling with the requirements of the Cyber Resilience Act (CRA). Now, the focus shifts from development to real-world validation and optimization.
Piloting the Tooling with Partners
A key step in this final phase is the piloting of our tooling with selected partners. The tools are now being tested on real products with digital elements provided by industry partners. This practical validation is essential to improve our tooling.
By applying the tooling to real-world use cases, we aim to:
- verify that the functionality works as intended in operational environments,
- identify potential gaps or areas for improvement,
- gather structured feedback directly from manufacturers, and
- further refine usability and efficiency.
Testing with authentic products ensures that CONFIRMATE does not remain a theoretical framework, but becomes a practical and reliable solution for companies facing CRA compliance requirements. Any shortcomings or optimization needs identified during the pilot phase will be systematically addressed in the upcoming iterations.
Automating Technical Documentation under the CRA
In parallel to piloting activities, we are intensifying our efforts to automate one of the most demanding aspects of CRA compliance: the generation of technical documentation.
The CRA requires manufacturers to maintain comprehensive technical documentation demonstrating conformity with cybersecurity requirements. This process can be resource-intensive—particularly for SMEs.
Within CONFIRMATE, we are exploring how recorded evidence generated by the tooling can be leveraged to automatically create structured technical documentation. By systematically collecting compliance-relevant data and transforming it into documentation artifacts, we aim to:
- reduce manual documentation effort,
- increase consistency and traceability, and
- support companies in meeting CRA obligations more efficiently.
The goal is to move from fragmented evidence collection to an integrated, semi-automated documentation workflow that aligns directly with regulatory requirements.
Upcoming Event: CRA Summit in Munich
We also plan to present the progress of CONFIRMATE at the upcoming CRA Summit in Munich this July. The presentation will provide insights into:
- the piloting phase and initial findings,
- the automation of technical documentation, and
- lessons learned from working with real products and partners.
The event will be an excellent opportunity to exchange with stakeholders, gather additional feedback, and further strengthen the community around CRA compliance and open-source tooling.
