Cyber Resilience Act (CRA) – What It Means in Practice and How Remion Integrates It into Software Development

Key Takeaways

  • The EU Cyber Resilience Act (CRA) introduces mandatory cybersecurity requirements for products with digital elements placed on the EU market.
  • Vulnerability reporting obligations begin in September 2026, with full compliance required from December 2027.
  • Responsibility lies with the entity placing the product on the EU market — compliance must be demonstrable and documented.
  • CRA requires risk-based secure design, structured vulnerability management, SBOM transparency, and security updates throughout the support period.
  • Technology partners must be able to prove compliance through documented development processes and traceable controls.
  • Remion is strengthening its Secure Software Development Lifecycle (SSDLC) to embed CRA-aligned cybersecurity into architecture, development, CI/CD, and update processes.
  • The result for customers: reduced regulatory uncertainty, improved resilience, and clearer shared responsibility across the supply chain.

The EU Cyber Resilience Act (EU 2024/2847) introduces mandatory cybersecurity requirements for products with digital elements placed on the EU market.

The first obligations, including vulnerability reporting requirements, apply from 11 September 2026. Full compliance will be required for products placed on the market from 11 December 2027.

Under CRA, the responsibility lies with the party that places a product with digital elements on the EU market. This entity must ensure that the product is developed and maintained in accordance with risk-based cybersecurity requirements, properly documented, and supported with security updates throughout the defined support period.

At Remion, we have assessed the impact of CRA both on our own solutions and on our customers’ operating environments. We are strengthening our development practices to ensure that regulatory requirements are systematically embedded into our solutions.

Remember These Dates

11 September 2026

  • The first obligations, including vulnerability reporting requirements, apply from

11 December 2027

  • Full compliance will be required for products placed on the market from

Risk-Based Cybersecurity

A central principle of CRA is risk-based implementation. Cybersecurity measures must be aligned with identified risk scenarios. Controls must correspond to documented risk assessments and realistic threat models.

Manufacturers must be able to demonstrate:

  • Risk-based secure design and development
  • Documented cybersecurity risk assessments
  • Structured vulnerability management
  • Security updates throughout the defined support period
  • Transparent reporting processes

This raises a practical question for our customers: Can our technology partners demonstrate compliance if required?

Compliance requires a structured and documented development model aligned with applicable standards.

Strengthening Our Secure Software Development Lifecycle

We are strengthening our Secure Software Development Lifecycle (SSDLC) and related development practices across projects.

Our focus is on ensuring that implemented cybersecurity measures are directly derived from risk assessments and that their rationale is documented and traceable.

Our Focus Areas

Unified Secure Development Practices

Security requirements are integrated already in the specification phase. Security acceptance criteria are defined to ensure implemented controls, such as code scanning, manual testing, and review processes correspond to identified risks.

Risk-Based Security Measures and Threat Modeling

We evaluate attack surfaces, trust boundaries, and critical components during product design and architecture planning. Early identification and prioritization of risk scenarios help ensure that cybersecurity measures remain proportionate and appropriate to the actual risk landscape.

SBOM and Vulnerability Management

We are implementing Software Bill of Materials (SBOM) practices and continuous CVE monitoring to maintain visibility into third-party components. Combined with a documented vulnerability management process, this supports faster response times and improved traceability.

Integrated DevSecOps Controls

Static (SAST), dynamic (DAST), and dependency scanning are embedded into our CI/CD pipelines. This supports continuous security verification and auditability.

Secure Update and Patch Management Processes

CRA requires security updates throughout the product’s support period. We are strengthening release and OTA processes to ensure secure, controlled, and documented updates.

What This Means for Our Customers

Our CRA-aligned development work provides clear benefits:

  • Reduced regulatory uncertainty
  • Demonstrable compliance readiness
  • Clear shared responsibility
  • Improved long-term resilience
  • Better supply chain transparency

In industrial and connected environments, structured and risk-based cybersecurity practices are essential.

At Remion, cybersecurity is integrated into product quality and lifecycle management. Our objective is to deliver secure, maintainable, and regulation-aware solutions that support long-term business continuity.

About The Author –Jesse Ikola

Jesse is passionate about building resilient and secure software solutions that meet both business and regulatory requirements. With hands-on experience in application development and complex technical environments, he focuses on practical cybersecurity and secure software development in industrial and connected systems.

#RemionCrew Goes Sappee!

What Would Remion Be Without a Little Adventure?

At Remion, we love creating opportunities to spend time together — and to try something new and exciting every time. This autumn, our team swapped laptops for helmets and hiking shoes as the #RemionCrew headed to Sappee for a day full of outdoor fun, fresh air, and laughter.

From the Office to the Hills of Sappee

Our journey began at the office, where the our crew gathered and made their way to Tampere Keskustori to hop on a bus headed to Sappee — leaving the city behind and heading straight into the heart of nature. Surrounded by forest trails, cozy cabins, and fresh autumn air, we knew a great day awaited us.

After getting settled into our cabins, it was time to gear up for the afternoon’s adventures.

The afternoon activities kicked off at rental station, where everyone could pick their favorite activity. Some jumped on electric fatbikes and sped off on scenic forest routes, while others tested their skills at the adventure park or the frisbee golf course. For those seeking a calmer pace, nature trails around Sappee offered the perfect way to enjoy the peaceful surroundings and the golden autumn colors.

No matter the activity, the day was full of good vibes, laughter, and just the right amount of friendly rivalry.

Dinner, Sauna, and Good Company

After a few hours outdoors, #Remioncrew gathered at Ekokammi log cabin for a delicious dinner. The evening continued back at the cabins, where saunas were heated and conversations flowed.

Recharged and Reconnected

As the bus rolled back to Tampere late in the evening, it was clear that the day had achieved its purpose — to recharge, reconnect, and remind us that teamwork isn’t built only in meetings, but also in moments like these.

Shared experiences like this are at the heart of Remion’s culture. They strengthen our bond, inspire new ideas, and remind us that great things happen when we step away from our desks together.

Saddling up on the electric FatBikes
Almost ready for the adventure park double checking the harnests.
Enjoying the wood routes
Relaxing at Ekokammi log cabin after dinner

Looking for new career opportunities?

Join #Remioncrew

Learn more

#RemionCrew Goes Sailing

What Would Remion Be Without Regatta?

The #RemionCrew headed out to sea just off the coast of Helsinki to take part in a friendly Regatta between three sailboats!
At Remion, we like to organize enjoyable activities together, always aiming to try something new and exciting. This time, our shared adventure was a sailing trip in the Helsinki archipelago.

Friendly Competition Guided by Professional Skippers

At the harbor, we went through the route and sailing instructions with guidance from the professional skippers of Nemo Sailing. After the briefing, we moved on to the boats to plan our tactics and practice race maneuvers.

The crews sailed the following vessels:

  • s/y Zorro, Swan 41, skipper Henri
  • s/y Alice, Bavaria 49, skipper Jari
  • s/y Stella, Finngulf 37, skipper Teemu

We divided the teams so that sailing experience was evenly distributed across the boats. The race itself was held as a pursuit start, with the winner being the first boat to cross the finish line. The finish was set near Vallisaari, where we also concluded the sailing trip.

s/y Alice awaits her crew.
With Teemu at the helm, the mood on board was just as bright as the sunshine
Vallisaari offered breathtaking views.

Stunning Views of Vallisaari Completed the Day

On Vallisaari, the spring outing continued with good food, sauna sessions, and enjoying the island’s beautiful scenery.
Shared moments and experiences are at the heart of what we do at Remion. It’s important that the team has time to relax and enjoy each other’s company outside of work as well. The sailing trip offered the perfect opportunity for this, and the breathtaking views of Vallisaari truly completed the day.
Events like this don’t just create great memories — they also strengthen team spirit. We’re already looking forward to the next adventure.

Looking for new career opportunities?

Join #Remioncrew

Learn more

Remion Participated in the Future Mobile Work Machine Event in Tampere

Remion participated in the Future Mobile Work Machine (FMWM) event at Tampere Hall on May 28–29, 2024. FMWM brought together manufacturers of mobile work machines, technology companies, and industry researchers to showcase demos and services, network, and discuss the future of the industry.

At the event, Remion presented its Remote Monitoring service together with Normet, a technology company specializing in mining and tunneling solutions.

“Normet has implemented remote monitoring at its control center in India. From there, the company monitors its customers’ equipment globally,” says Remion CEO Jukka Kivimäki.

The remote monitoring service provides real-time supervision, usage reports, and data-driven recommendations to help maximize equipment availability and optimize performance.

Normet’s own experts remotely oversee and guide local maintenance operations using up-to-date equipment usage and fault data.

Normet has implemented Remion’s remote monitoring service globally through its control center

–Eric Stigzelius, Senior Manager at Normet

Progress Toward Autonomous Mobile Work Machines

The event presentations offered valuable insights into the direction in which mobile work machine technology is evolving and how digitalization, electrification, artificial intelligence, augmented reality, and sustainability requirements will transform business operations and production environments in the coming years.

A central theme of the event was machine autonomy. Remion CTO Miika Okko highlighted a presentation by Agco that reflected many of the themes discussed by various equipment manufacturers.

“Pekka Ingalsuo from Agco outlined six key areas required for machine automation: route planning, vehicle control, obstacle avoidance, local navigation, process automation, and vehicle condition monitoring.”

Companies specializing in machine control systems were also present, developing driver-assistance technologies.

Mobile work machines are gradually moving toward partial autonomy through advanced assistance systems

– Jukka Kivimäki, CEO at Remion

According to Okko and Kivimäki, autonomy—both of mobile work machines and production environments—was one of the most prominent themes at the event.

A Vision of an Autonomous Production Environment

A presentation by Konecranes CTO Franz Schulten introduced a vision of an Industrial Metaverse — a future production environment enabling dynamic collaboration between humans and machines — which sparked interest among the Remion team.

In the Industrial Metaverse, not only are devices autonomous, but the production facility itself operates autonomously by utilizing intelligent technologies and AR solutions.

“The remote monitoring service we presented at the event could be one of the tools within the Industrial Metaverse. It provides visibility into equipment condition and helps maintenance personnel and operators keep machines operating efficiently,” Kivimäki explains.

“At Remion, we have both the interest and the capability — along with a comprehensive understanding — to help build tools for future production environments that simplify customer operations and improve process efficiency,” Kivimäki continues.

“We have strong analytics and data modeling expertise that can support the development of autonomous production environments, for example in modeling the environment itself,” Okko adds.

Breaking Barriers in Mining: Normet Xrock and Remion Pioneer Autonomous Rock Breaking

In the depths of mining operations, rock breaking has always been one of the toughest challenges. Dangerous, unpredictable, and often a bottleneck that slows everything down, it has long demanded human skill in environments where safety is never guaranteed.
Normet Xrock, a global leader in rock-breaking solutions, set out to change that story. With its Xrock product line of breaker booms and advanced attachments, the company envisioned a future where technology could take on the danger, leaving people free to focus on higher-value work. The bold ambition: to create the world’s first autonomous rock-breaking system.

Read more

The Initial Hype Around Electrification and AI Is Fading — Safety and Sustainability Gaining Focus

According to the Remion team, last year’s discussions at the event focused more heavily on electrification.

“Now safety and sustainability were more prominent. Electrification is no longer a new concept — it’s already underway. It feels like companies are shifting their focus toward equipment safety and sustainable, responsible operations,” Kivimäki reflects.

Volvo’s Deputy CEO Carolina Diez Ferrer stated in her presentation that Volvo aims to achieve carbon neutrality by 2050.

“Volvo aims to bring carbon-neutral enabling equipment to market by 2040, so that these machines would already be in operation ten years before the 2050 carbon-neutrality target,” says Okko.

“Hybrid solutions were also discussed. Pekka Ingalsuo from Agco noted that combustion engines cannot yet be completely replaced at this stage,” Okko continues.

Okko also observed that the initial excitement surrounding artificial intelligence has stabilized.

With AI, we’ve returned to realism – AI is part of future solutions, but it will not solve everything on its own

– Miika Okko, CTO at Remion

#RemionCrew in Spain – Remote Work Strengthened The Team

Remion’s five-person team packed their laptops and shorts and headed to Fuengirola, Spain, for a two-week remote work trip.

“Our timing couldn’t have been better. In Fuengirola, daytime temperatures climbed well above 20°C, while back in Finland we were hit by a surprise return of winter,” says Petri Tuominen, Project Manager at Remion, who joined the trip.

Working remotely abroad is nothing new for the company. Remion’s first trip combining work and shared leisure time took place in Marbella in 2020, just before the global COVID-19 pandemic changed the world.

An Office on the Costa del Sol

Finding suitable workspaces for a short remote-work period required some quick problem-solving.

“One challenge was finding office space on short notice. We chose a local office through FuengirolaOffices.com, located in the Centro Finlandia building. The office had a reliable internet connection and sufficient work facilities,” Tuominen explains.

The change of scenery also enabled the team to spend meaningful time together outside work. The two weeks were filled with a wide range of activities: beach time and sunshine, hiking Antennivuori, playing frisbee golf on the mountainside, sauna sessions, go-karting, a day trip to Gibraltar, tapas, a gaming museum visit, and of course exploring the Finnish communities in Fuengirola.

“Our schedule was packed but enjoyable. Not a single boring moment,” Tuominen says.

Deeper Interaction with Colleagues

The Remion team’s experiences of remote work in Fuengirola were positive on many levels. Opportunities to get to know colleagues better feel especially valuable in today’s post-pandemic working life, where in-person office interactions have significantly decreased.

“During the trip, we interacted with each other in new ways, and everyday working life took on a different rhythm during those two weeks.”

From a productivity standpoint, the trip was also a success. Participants felt that the remote office environment had a positive impact on their work efficiency.

Remote Work in Spain Was a Success

Overall, participants gave the trip a perfect score of 5/5. Feedback collected after the trip suggests that Remion’s remote work travel may very well continue in the future.

According to participants, the best parts were: “Warmth, light, spending time with great colleagues, a change of scenery, and experiencing new things.”

According to Petri Tuominen, Remion’s two-week remote work trip to Fuengirola was a clear success.

“The trip gave us the opportunity to work in amazing surroundings, but it also strengthened our team cohesion and gave us new perspectives and ideas.”

Looking for new career opportunities?

Join #Remioncrew

Learn more

Digital twin lifts benefits of machine data to a new level

Machine information – concerning design models, manufacturing, remote monitoring and service – is typically dispersed in different enterprise systems. Data is collected but not systematically utilized by business driver. Digital twin combines all machine lifecycle data enabling new business models, digital services and new data optimized machine design methods.

How can machine manufacturers and end customers benefit from digital twin?

With actual and predicted machine data of digital twin the end customer can be informed of maintenance needs, improve customer process and decrease machine lifetime cost. For machine manufacturer digital twin enables increased maintenance business and new business models and digital services enhancing whole Industry 4.0 smart factory-readiness.

The remote monitoring solution developed to Mantsinen collects and transmits data from sensors in each machine to a global cloud service. The data is automatically refined and visualized according to end-user’s needs.
It’s important that maintenance, product development and business managers can fully benefit from the data.

–Jukka Kivimäki, CEO Remion

Remion is collaborating on digital twin project with Mantsinen Group

Remion is the supplier of remote monitoring for Mantsinen Group’s material handling machines. Now Remion also provides them tools to create digital twin environment which Mantsinen Group utilizes for their business model and digital service development.

Watch the video of the digital twin collaboration of Remion and Mantsinen

The video is produced by Business Finland.

Remion’s AI Expertise and Experience Secured Victory at Industryhack – Innovating Intelligent Laser Welding

Remion’s team was able to leverage its extensive technological expertise in an Industryhack co-creation project, where the host company Coherent sought solutions to enhance its welding process. In the challenge competition, Coherent—a provider of laser and photonics solutions—was looking for a partner to develop a next-generation laser welding system utilizing sensor data and artificial intelligence.

Remion claimed its first Industryhack victory in strong competition. In addition to Remion, three other Finnish AI specialist companies were selected from all applicants. The three-day challenge took place in early June.

Remion’s CTO, Miika Okko, is delighted with the team’s win. Expectations for the competition were high, and the initial outlook was positive.
– Coherent’s challenge focused on building an intelligent laser ecosystem, where our expertise and solutions were an excellent fit.

Coherent aims to deliver added value to its customers through a more precise and optimized welding process.

Miika Okko served as the team lead for Remion during Industryhack.

A Three-Person Team Built on Complementary Expertise

Remion’s competition team combined diverse expertise.
– Our CEO Jukka brought strong business insight into building a comprehensive solution tailored to the customer’s needs. Petri, who works as a specialist, has extensive experience in designing and technically implementing AI solutions. As team lead, I guided the collaboration throughout the process, Okko explains.
Okko himself has a broad background in AI research, which was also the subject of his doctoral dissertation.

From Intensive Ideation to a Structured Winning Solution

During the competition days, ideas evolved into a well-defined winning concept through intensive innovation, solution refinement, and mentoring.
– Ultimately, three interwoven factors led us to victory: identifying the core customer need, delivering an innovative technical implementation, and presenting the solution clearly and convincingly.

Through preliminary discussions, the team gained additional insights from the host company, helping them refine their direction and develop a highly targeted proposal addressing the customer’s needs.
– We were also able to leverage our Regatta® platform in the solution, enabling faster and more cost-efficient implementation.

Defining the solution architecture, outlining the implementation, and preparing the Proof of Concept descriptions required close collaboration—at times working late into the night.
– Assembling the concept into a visually compelling format is also crucial. A good solution alone is not enough—you must be able to communicate the solution and its benefits effectively, Okko emphasizes.

A new element in this year’s competition was a two-minute video presentation, through which each team had to showcase their solution in the final round.

Proven Long-Term Performance of Remion’s Solutions

One of the jury’s key justifications for selecting Remion in Coherent’s laser welding system development challenge was that Remion’s analytics and AI expertise and solutions have been proven effective over the long term. This makes it fast and straightforward for the company to move forward with implementing a comprehensive solution.

Remion has extensive experience in developing analytics solutions across various industrial sectors, including predictive maintenance, failure forecasting, alarm and vibration analysis, and production optimization.

Remion is an experienced industrial player in AI and analytics.
– We have predicted usage-based maintenance needs and identified machines and data collection units behaving abnormally.
– We also have strong expertise in statistical analysis of big data, as well as structuring and aggregating data. A comprehensive situational overview can be created, for example, by combining data from multiple machines, Okko explains.

A New Business Opportunity Can Be Found by Using Existing Data in a New Way

A New Business Opportunity Can Be Found by Using Existing Data in a New Way

Remion’s CEO Jukka Kivimäki and Konecranes’ Matti Lehto, Director, Product Lifecycle, shared multiple perspectives on the business potential of IoT at the Aalto University DigiTwin workshop on September 17, 2019. The workshop is part of the DigiTwin project organized by Aalto University together with Konecranes, Remion, and other partner companies, and funded by Business Finland. The goal of the project is to strengthen the ecosystem built around digital twins in Finland.

We asked Matti Lehto how Konecranes has utilized IoT and digital twins so far in its global crane business, and how he sees their business potential both within the company and in Finnish industry more broadly. At the same time, we discussed the new opportunities created by digital twins.

Finding New Perspectives at the Edges of Core Business

Konecranes has been utilizing IoT and building IoT-based business for several years. Like Remion, Konecranes is also involved in the DigiTwin project by Aalto University and Business Finland, where, among other things, a digital twin of a crane has been developed.

According to Matti Lehto, from a business perspective, the most feasible ideas for applying digital twins or IoT emerge when staying close to existing business and searching for new business ideas at its edges.

“A business opportunity can be found by using data that has already been collected in a slightly different way than before. That brings you closer to practical value.”

In a hypothetical example, Lehto describes a crane moving high above a factory floor. Combined with a thermal camera, it could be used to detect the early stages of fires quickly and accurately. By utilizing location data, initial fire suppression could be precisely targeted at the affected area, instead of sprinklers spraying water everywhere. At the same time, the crane—connected to the network via a modem—could trigger a fire alarm.

“Sometimes an idea can be relatively easy to implement, but its profitability must of course be evaluated against the required effort and investments.

More Precise Information on Crane Usage and Components to Guide Sales

Konecranes utilizes digital twins in its service systems. Through them, fault data and usage data are collected from equipment in the field, including crane movements, accelerations, braking events, and loads. The equipment’s usage profile is used to optimize maintenance, enabling crane owners to receive service actions that best support the actual usage of their equipment.

According to Lehto, Konecranes aims in the future to better combine crane usage data with component-related information.

“When we gather statistical analysis from large numbers of different devices—identifying which components have performed well under certain conditions and usage levels—we can guide crane sales more effectively based on real-world data. Our customers would receive crane models, components, options, and accessories that truly fit their industry and application.”

Using Data to Guide Product Development

Konecranes also uses equipment data when developing the next generation of products.

“Based on data from equipment in use, we can evaluate how well our designed equipment, its features and components, and structural dimensioning have met actual usage needs, and which components have been prone to failure. We can further enhance this product development guidance by extending the evaluation to broader data samples,” Lehto explains.

“In product development, profitability must also be considered so that we do not develop equipment that is too expensive and uncompetitive. DigiTwin and IoT solutions must not significantly increase the price of the product being sold,” he adds.

Digital twins have also been used at Konecranes as defining design models for products. In some cases, simulation features have been added to these models, enabling the company to demonstrate crane performance precisely within specified limits.

“The Costs of IoT Components Can Change Rapidly”

According to Matti Lehto, Finland is still at an early stage in terms of IoT and digital twin opportunities.

“There are companies that have managed to make IoT profitable from a single use-case perspective, but relatively few have succeeded in leveraging it profitably at a broader scale. Of course, for a smaller company, even one successful use case can already represent good business.”

Lehto notes that the situation is interesting because the costs of elements required for IoT can change rapidly. As the implementation of digital twins or the collection of associated data becomes more affordable, commercialization becomes easier from a cost perspective.

“If technology develops in a certain direction and implementation costs decrease, companies may find themselves in a hurry to build the business capabilities needed to harness these emerging opportunities profitably.”

“Expanding into new areas of operation always causes internal transformation within a company, which may involve changes in job roles or the redirection of competencies,” Lehto reflects.

Come and Learn About the Business Opportunities and Benefits of IoT

Remion is participating in Aalto University’s DigiTwin research project, where researchers and partner companies jointly develop IoT solutions to support Finnish industry in its digital transformation.

The DigiTwin workshop, held at Aalto University on September 17, 2019, is an open event for everyone interested in gaining insights, sharing experiences, and generating new business ideas enabled by the Internet of Things (IoT) and digital twins. A digital twin is a broad concept that combines multiple technologies, such as simulation, IoT, and artificial intelligence.

Register for the DigiTwin Workshop

During the morning session of the DigiTwin workshop, you will learn about the practical benefits of IoT and digital twins through presentations by invited speakers and DigiTwin project partners. From Remion, CEO Jukka Kivimäki will discuss the business potential of IoT and digital twins together with Matti Lehto, Program Manager of Lifecycle Process at Konecranes.

In the afternoon, the workshop program focuses on ideating new business opportunities based on participants’ goals and resources.

The workshop is organized by Aalto University, Konecranes, and Remion as part of the DigiTwin project funded by Business Finland. The event aims to strengthen the network built around digital twins in Finland.

How Can a Digital Twin Support Product Development?

In what ways can a digital twin be utilized in device design, product development, and business optimization? Answers to this question were explored from multiple perspectives—both research and industry—at the DigiTwin project demo day on January 18, 2019.

As one of the partner companies in Aalto University’s DigiTwin project, Remion also participated in the demo day, presenting a digital twin developed for Framery’s phone booth.

“A digital twin provides new insights into how phone booths are used, the user experience, and how people behave inside the booths. Product development teams can analyze this data and use it to further improve the phone booths,” says Miika Okko, Senior Solution Architect at Remion and developer of the Framery digital twin.

The digital twin has been under development for approximately one and a half years, with two phone booths involved in the demo phase. Data is collected on factors such as booth ventilation and lighting, usage rate, as well as user posture, activities, and overall user experience.

“The end user receives access to a comprehensive tool that allows each user to easily obtain exactly the information they need,” Okko explains.

Creating Commercial Opportunities Together with the Customer

The digital twin of Framery’s phone booth has generated tremendous interest. At the DigiTwin demo day, the presentation sparked several audience questions about commercialization possibilities, such as whether phone booth users could access data about their own usage.

“At this stage, Framery’s digital twin serves as an experimental platform that enables our customer to better understand what happens inside the booth through the collected data. After that, it is up to them to decide how to utilize the information and whether to build new business models around it,” says Remion’s CEO, Jukka Kivimäki.

Ready to take the next step?

Let’s explore how data can improve your operations, unlock new revenue, and drive smarter decisions.

Get in touch