EU INC: Don’t Let It Become Just Another Registration Form
This newsletter has often reported on EU INC, the new framework that would let young companies set up directly at European scale. The project is now at risk. Lobbying efforts are trying to strip out the very features that would make it a real game-changer.
Two core elements are under threat. The first is free choice of registration. The second is a common stock option framework, which startups need to attract talent. Other important provisions are also on the table. Without these, it is unclear what would be left to make EU INC the European standard it was meant to be.
The original ambition was to help startups attract talent, access capital and scale across borders. Instead, EU INC risks becoming little more than a faster way to incorporate. That would be a missed opportunity for Europe’s competitiveness and for the founders who are counting on it.
The EU INC support team is calling for more pressure on the EU institutions to keep the framework’s core intact. The European Champions Alliance fully supports this call. We encourage our members and partners to add their voices.
Industry Gears Up for the EU Cyber Resilience Act
Cybersecurity is no longer a feature you add at the end. Under the EU Cyber Resilience Act (CRA), it is becoming a condition for selling any connected product in Europe. Industry is starting to respond with practical tools.
On 16 October, L’Embarqué reported that electronics distributor Mouser Electronics and chipmaker Microchip Technology have published a free e-book for hardware engineers: Designing for the Cyber Resilience Act: Securing Connected Devices from First Schematic to Final Decommissioning. It draws on the work of Tim Scherer, Microchip’s principal embedded solutions engineer for cyber-resilience.
What the CRA asks of manufacturers
The CRA covers almost any “product with digital elements”: hardware or software that connects, directly or indirectly, to another device or a network. Its first obligations are already live, and the main ones apply in just over a year.
The regulation entered into force on 10 December 2024 (NCSC Ireland). Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents through ENISA’s Single Reporting Platform. They must send an early warning within 24 hours, a full notification within 72 hours, and then a final report (Jones Day). From 11 December 2027, products must meet the CRA’s essential cybersecurity requirements before they can carry the CE marking and be sold in the EU.
Non-compliance can cost up to €15 million or 2.5% of worldwide annual turnover, whichever is higher. Reporting already applies to products on the market today, not only new designs.
Inside the guide: security from schematic to scrapyard
The e-book follows a device through its whole life, which is exactly how the CRA frames responsibility.
Scope first. How to tell whether a product falls under the CRA, and which deadlines and standards apply.
Risk-based design. Assess risk from the product’s intended use, the data it handles and its connections. Then apply “secure by design” and “secure by default”.
Core protections. A trusted boot chain, firmware integrity, protected keys and encryption of sensitive data, anchored in a hardware root of trust such as a secure element.
Prototype to production. Start with pre-configured parts, then plan how keys and certificates are provisioned securely at scale.
Lifecycle and end of life. Manage device identities, credentials and updates from commissioning to secure decommissioning.
It is also a product showcase. Microchip’s ATECC608C secure element, its Trust Platform development kits and its TrustMANAGER and keySTREAM provisioning services appear throughout. Readers should take the method and treat the product picks as one option among several.
Why it matters for European industry
The guide is a small piece of news, but it shows a bigger shift. Rules first written in Brussels are now turning into engineering checklists, component choices and supplier offerings.
