Cyber ​​Resilience Act reporting obligation: PHYTEC combines module, BSP and device lifecycle management

What the CRA requires

The reporting obligation under Article 14 is staggered: early warning within 24 hours, supplementary information within 72 hours, final report no later than 14 days after the release of a security update. It applies regardless of the product class and also to ProductsThese are products that were released years ago. In practical terms, this means that a manufacturer must know which software components are in their product, be able to repair them in the field, and be able to demonstrate both. Anyone who hasn't embedded these three capabilities in their product architecture will be unable to meet the deadlines operationally.

phyHUB: the operating level above the module

Since 1985, PHYTEC has been developing and manufacturing System-on-Modules and Single-Board Computers in Mainz, Germany, and supplying well-maintained Board Support Packages based on Yocto/OpenEmbedded, Linux, and Zephyr RTOS. phyHUB complements this foundation with the operational layer: signed over-the-air updates with staging and rollback, fleet and asset management, device health monitoring, and automated vulnerability checks against the SBOM.

The operating model is crucial. phyHUB is a multi-tenant platform operated by PHYTEC – most manufacturers don't want to operate a platform, but rather control their own devices and fulfill their obligations. PHYTEC thus complements ML!PA's offering with a level that doesn't exist there: ML!PA delivers L-IoT as a standalone installation for each customer, which the customer then operates themselves. Where such an installation is required, customers contact ML!PA directly – on the same platform, without having to change systems.

phyHUB is also the channel through which PHYTEC delivers its own maintenance services: software lifecycle management and CVE-Services They are connected to the maintenance infrastructure in Mainz. All BSP maintenance, vulnerability assessment, and security updates generated there reach the entire fleet of devices via the same platform. This means the chain doesn't end with a tool, but with a service.

The anchor of trust is being created in Mainz

Every update chain is only as robust as the key with which it begins. PHYTEC handles key generation, key management, encryption, and Secure Boot provisioning in its own manufacturing facility in Mainz – physically and under German law. The module leaves the facility already equipped with its identity. This level of performance cannot be replicated in software.

In the ProductsSoftware is becoming increasingly important for our customers – and especially its maintenance. With the Cyber ​​Resilience Act, this maintenance will become a market access requirement from 2027 onwards. Anyone who cannot securely update their product will no longer be allowed to market it. And those who can no longer market it will no longer be able to purchase modules. For us, L-IoT is the complementary software layer to our System on Modules: hardware-agnostic, brownfield-capable, and open to the devices our customers already have in the field.
– Bodo Huber, Managing Director, PHYTEC Messtechnik GmbH

We don't rent out a platform; we deliver a dedicated installation for each customer – and they can operate it themselves. Hardware-neutral, fully controllable via APIs, and we don't interfere with the data path at any point during operation. Anyone responsible for a product for ten years doesn't want to depend on whether their platform provider will be responsible for that same duration. With PHYTEC, we now reach both customer groups: those who need precisely this control, and those who prefer to entrust operations to a provider they trust.
– Tobias Maier, Managing Director, ML!PA Consulting GmbH

What customers specifically gain

• A traceable chain from the module to the signed OTA delivery in the field – on suitable modules including Secure Boot.
• Tools for fulfilling CRA obligations: SBOM tracking, signed artifacts, vulnerability analysis, audit trail. Notification and declaration of conformity remain with the manufacturer.
• No need to operate your own platform – even for manufacturers without their own IT department.
• A management system for mixed fleets of devices: PHYTEC module or third-party hardware, new development or existing equipment.

Operations and data processing

phyHUB is operated by PHYTEC Messtechnik GmbH as a multi-tenant platform with client isolation. The operating platform is Microsoft Azure, Europe West region. PHYTEC is the customer's contractual partner and data processor; ML!PA is involved as a subcontractor. Key generation, encryption, and secure boot provisioning do not take place in the cloud, but at the production facility in Mainz.

Availability

The first reference integrations of PHYTEC modules with phyHUB will be available from the fourth quarter of 2026. PHYTEC will provide an initial technical preview on September 22, 2026, at the Elektronik Solution Day in Stuttgart. The solution can be seen live at electronica in Munich (November 10–13, 2026) and at SPS in Nuremberg (November 24–26, 2026).