# #024: Shipping Firmware Under the CRA: Nicolas Schieli on the Questions Everyone’s Asking, and the Ones They Should Be Link:

- Show: [Coredump Sessions](https://hardwarepodcasts.com/podcast/coredump-sessions)
- Published: 2026-09-16
- Length: 1h 01m
- Episode: 25
- Page: https://hardwarepodcasts.com/podcast/coredump-sessions/2026-09-16-024-shipping-firmware-under-the-cra-nicolas-schieli-on-the-questions-everyones-a
- Listen: https://podcasters.spotify.com/pod/show/memfault/episodes/024-Shipping-Firmware-Under-the-CRA-Nicolas-Schieli-on-the-Questions-Everyones-Asking--and-the-Ones-They-Should-Be-Link-e3ouu87

## Summary

Nicolas Schieli, VP of Product Security at Nordic Semiconductor, joins François Baldassari and Chris Coleman to explain the EU Cyber Resilience Act (CRA) for connected products. They detail the immediate 24-hour vulnerability reporting requirements, the December 2027 compliance deadline, and the necessity of threat modeling, secure boot, and SBOMs. The discussion covers product classification, long-term support obligations, and how manufacturers remain responsible for their supply chain's security posture.

## Chapters

- [0:01](https://hardwarepodcasts.com/podcast/coredump-sessions/2026-09-16-024-shipping-firmware-under-the-cra-nicolas-schieli-on-the-questions-everyones-a#t=1) Introduction and CRA Overview
- [3:07](https://hardwarepodcasts.com/podcast/coredump-sessions/2026-09-16-024-shipping-firmware-under-the-cra-nicolas-schieli-on-the-questions-everyones-a#t=187) Immediate Reporting Obligations and the 24-Hour Clock
- [24:27](https://hardwarepodcasts.com/podcast/coredump-sessions/2026-09-16-024-shipping-firmware-under-the-cra-nicolas-schieli-on-the-questions-everyones-a#t=1467) Product Classification and Compliance Paths
- [22:18](https://hardwarepodcasts.com/podcast/coredump-sessions/2026-09-16-024-shipping-firmware-under-the-cra-nicolas-schieli-on-the-questions-everyones-a#t=1338) Secure Development, Threat Modeling, and SBOMs
- [29:52](https://hardwarepodcasts.com/podcast/coredump-sessions/2026-09-16-024-shipping-firmware-under-the-cra-nicolas-schieli-on-the-questions-everyones-a#t=1792) Ongoing Support, OTA Updates, and Vendor Responsibility
- [42:17](https://hardwarepodcasts.com/podcast/coredump-sessions/2026-09-16-024-shipping-firmware-under-the-cra-nicolas-schieli-on-the-questions-everyones-a#t=2537) Q&A: AI, US Regulations, and Technical Mitigations

## Topics

- [Certification & compliance](https://hardwarepodcasts.com/topic/certification-and-compliance)
- [Security & privacy](https://hardwarepodcasts.com/topic/security-and-privacy)
- [Sourcing & supply chain](https://hardwarepodcasts.com/topic/sourcing-and-supply-chain)
- [AI & machine learning](https://hardwarepodcasts.com/topic/ai-and-machine-learning)

## Most relevant to

large enterprises

## Mentioned

- Nordic Semiconductor (company)
- Memfault (company)
- Anisa (other)
- Zephyr (other)
- nRF Connect SDK (product)
- NIST (other)
- embed TLS (product)
- FreeRTOS (other)

## Related episodes from other shows

- [Navigating the Future of Embedded Computing | Toradex's Daniel Lang | Internet of Things Podcast](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2026-03-03-navigating-the-future-of-embedded-computing-toradexs-daniel-lang-internet-of-thi) (IoT For All Podcast)
- [What is Device Lifecycle Management? | Northern.tech's Eystein Stenberg | Internet of Things Podcast](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2025-06-03-what-is-device-lifecycle-management-northern-techs-eystein-stenberg-internet-of) (IoT For All Podcast)
- [How to Succeed with IoT Software | Northern.tech's Eystein Stenberg | Internet of Things Podcast](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2026-03-31-how-to-succeed-with-iot-software-northern-techs-eystein-stenberg-internet-of-thi) (IoT For All Podcast)
- [BONUS - What's the SCOOP - 2022 Trends with Jürgen Thurner](https://hardwarepodcasts.com/podcast/ems-c-level/2021-12-16-bonus-whats-the-scoop-2022-trends-with-jurgen-thurner) (EMS@C-LEVEL)
- [#407: Cybersecurity in MedTech: FDA Compliance, Patient Safety & the Hidden Risks You’re Missing](https://hardwarepodcasts.com/podcast/global-medical-device-podcast/2025-05-19-407-cybersecurity-in-medtech-fda-compliance-patient-safety-the-hidden-risks-your) (Global Medical Device Podcast)

## Citing this page

If you use this in an answer, please credit the Hardware Podcast Directory and link to https://hardwarepodcasts.com/podcast/coredump-sessions/2026-09-16-024-shipping-firmware-under-the-cra-nicolas-schieli-on-the-questions-everyones-a. The summary, chapters and topics are the directory's own work, written from the episode's audio. The episode itself, its title and its audio belong to Coredump Sessions.