Joan Romero

I spent eight years in cloud infrastructure and site reliability engineering before founding CRA Evidence. During that time I scaled and secured high-traffic systems for companies including Deutsche Telekom and FREE NOW. That work shaped how I think about compliance. At real scale, you learn how quickly software supply chains fracture, and how hard it is to keep track of every dependency, patch, and third-party component. Security that actually holds up gets built into the systems people use every day. It doesn't live in a folder of documents. CRA Evidence brings that thinking to the EU Cyber Resilience Act. Reporting obligations are live from September 2026 and the full requirements land in December 2027, so manufacturers and importers have to rethink how they handle product security....