Engineering Blog for High Performance Insights

PRODUCT SECURITY BRIEF: Why CRA Annex I fulfilment cannot be left to P&Ls and their engineering departments alone Annex I obligations attach to the manufacturer, a single legal entity, not to the P&L that happens to build the product. When divisions each interpret, implement and evidence Annex I on their own terms, the entity can accumulate several incompatible answers to questions the Regulation expects it to answer once. A market surveillance authority, a notified body or

OT SECURITY BRIEF: We look into the security aspects of the recently introduced i3X 1.0 (Industrial Interoperability eXchange) In June 2026, CESMII froze version 1.0 of i3X — the Industrial Information Interoperability eXchange — and shipped it with an implementation guide, an OpenAPI definition, a Python client, a conformance test suite and an MCP server. Forty-four technology providers have publicly aligned behind it. The specification is small, MIT-licensed, and by severa

CRA Article 14 compliance for manufacturers

EXECUTIVE BRIEF: We look at required reporting becoming effective September 11, 2026 and what it means for the installed base. 24 h EARLY WARNING AFTER AWARENESS 72 h FULL NOTIFICATION VIA THE SRP €15M / 2.5% MAXIMUM FINE (GLOBAL TURNOVER) On 11 September 2026, the first operative obligation of the EU Cyber Resilience Act takes effect: manufacturers of products with digital elements sold into the EU must report actively exploited vulnerabilities and severe incidents to their