CRA reporting obligations are now in effect: PHYTEC connects module, BSP and device lifecycle management

What the CRA requires

The reporting obligation under Article 14 is staged: an early warning within 24 hours, supplementary information within 72 hours, and a final report no later than 14 days after a security update has been made available. It applies regardless of product class, and it applies to products placed on the market years ago. In practice, a manufacturer needs to know which software components are inside its product, needs to be able to fix them in the field, and needs to be able to evidence both. Without these three capabilities designed into the product architecture, the deadlines cannot be met operationally.

phyHUB: the operations layer above the module

PHYTEC has been developing and manufacturing System on Modules and Single Board Computers in Mainz since 1985, supplying them with maintained Board Support Packages based on Yocto/OpenEmbedded, Linux and Zephyr RTOS. phyHUB adds the operations layer on top of that foundation: signed over-the-air updates with staging and rollback, fleet and asset management, device health monitoring, and automated matching of known vulnerabilities against the SBOM.

The operating model is what matters. phyHUB is a multi-tenant platform run by PHYTEC – most manufacturers do not want to run a platform; they want control over their devices and compliance with their obligations. PHYTEC thereby extends ML!PA's offering with a tier that does not exist there: ML!PA delivers L-IoT as a dedicated, single-tenant installation that each customer runs themselves. Where such an installation is required, customers go directly to ML!PA – on the same platform, with no change of system.

phyHUB is also the channel through which PHYTEC delivers its own maintenance services. Software Lifecycle Management and CVE services are connected to PHYTEC's maintenance infrastructure in Mainz. Whatever is produced there – BSP maintenance, vulnerability assessment, security updates – reaches the device fleet through the same platform. The chain therefore ends not with a tool, but with a service.

The root of trust is created in Mainz

Any update chain is only as sound as the key it starts from. PHYTEC performs key generation, key handling, encryption and secure boot provisioning in its own production facility in Mainz – physically, and under German law. The module leaves the building with its identity already in place. This is not something software can replicate.

Software is becoming more important in our customers' products – and above all, maintaining that software. With the Cyber Resilience Act, this maintenance becomes a prerequisite for market access from 2027. A manufacturer that cannot securely update its product will no longer be allowed to place it on the market. And a company that no longer places products on the market will not be buying modules either. For us, L-IoT is the complementary software layer to our System on Modules: hardware-agnostic, brownfield-capable and open to the devices our customers already have in the field.
– Bodo Huber, Managing Director, PHYTEC Messtechnik GmbH

We do not rent out a platform. We deliver a dedicated installation per customer – and that customer can run it themselves. Hardware-neutral, fully controllable via APIs, and in day-to-day operation we sit nowhere in the data path. Anyone responsible for a product over ten years does not want to depend on whether their platform vendor will still be there just as long. With PHYTEC, we now reach both groups of customers: those who need exactly that level of control, and those who would rather place operations in the hands of a supplier they trust.
– Tobias Maier, Managing Director, ML!PA Consulting GmbH

What customers gain

• A traceable chain from the module through to signed OTA delivery in the field – including secure boot on suitable modules.
• Tools to meet CRA obligations: SBOM tracking, signed artefacts, vulnerability matching and an audit trail. Reporting and the declaration of conformity remain with the manufacturer.
• No platform operations of your own – suitable for manufacturers without an in-house IT department.
• One management system for mixed device fleets: PHYTEC module or third-party hardware, new design or installed base.

Operations and data processing

phyHUB is run by PHYTEC Messtechnik GmbH as a multi-tenant platform with tenant isolation. It is hosted on Microsoft Azure, region Europe West. The customer's contracting party and data processor is PHYTEC; ML!PA is engaged as a sub-processor. Key generation, encryption and secure boot provisioning take place in the Mainz production facility, not in the cloud.

Availability

The first reference integrations of PHYTEC modules with phyHUB will be available from the fourth quarter of 2026. PHYTEC will give an initial technical preview at Elektronik Solution Day in Stuttgart on 22 September 2026. The solution can then be seen live at electronica in Munich (10–13 November 2026) and at SPS in Nuremberg (24–26 November 2026).