What do the CRA and the Data Act change for our connected product?
Since 11 September 2026 you have to report actively exploited vulnerabilities and severe security incidents, including for products already in the field (CRA, Articles 14 and 69(3)). For every device placed on the market from 11 December 2027 the CRA applies in full: security updates over a support period of at least five years, shorter only where the product is expected to be in use for less, with its end stated at the sale. A connected product placed on the market after 12 September 2026 also has to be designed so that its data is accessible to the user by default (Data Act, Article 3). In the audit we prepare every requirement technically so that your legal team can decide it, and map it to one of the six decisions.
Our product is already in the field. Is it too late?
No, but the questions shift. For the installed base it is about which devices an update can reach at all, who signs, and which end dates in the stack are already fixed; for the next generation it is the six decisions before launch. The audit keeps the two apart.
We want to move off our IoT platform. How do we go about it?
First the inventory: which devices and generations are in the field, what the old platform does for them, and which contracts and end dates apply. Then select the new platform against the six decisions, before any contract is signed. The migration itself goes out through the old platform while it still runs, with a rollback path for devices that come back online only months later. I have led such a migration myself.
When is a redesign necessary?
When the architecture no longer meets an obligation or will not outlast an end date: a discontinued module, a switched-off network, updates without a signature and a rollback path, a support period the components cannot deliver, or operating costs that grow with every unit. The audit shows what can still be solved in the installed base and what only the next generation can do.
How do we choose an IoT or OTA platform?
Device side first: functional safety requirements, rollback and recovery constrain the platform choice more than the other way round. Then a specification against the six decisions, and a sign-off by someone who earns nothing from the contract. Ask every vendor where the signing key lives.
We already have an IoT platform. Is this still worth it?
Often precisely then: whether the business model on the platform makes money, and whether you could still switch in three years.
Isn’t this just technology consulting?
I ask the technical questions because they have commercial consequences. I had commercial responsibility for an IoT platform, with a P&L, a team and customers.
How does this relate to agentic AI?
An agent needs what a connected product needs: a person who owns it, a rollback path after every change and an exit when a vendor drops out. Its context comes from the data and the asset semantics of this foundation.
What ties do you still have to Bosch?
None: no non-compete, no ongoing contracts, no commission. What I learned at Bosch stays confidential.
Do you work outside Europe?
EU-wide with a base in Gevelsberg and Athens. Outside Europe selectively, through existing OEM or platform-vendor relationships.
