Embedded World 2026 Preview
Why This Year’s Show Will Be All About Compliance Readiness
When the embedded community descends on Nuremberg from March 10–12 for Embedded World 2026, the conversation will feel markedly different from last year’s event. In 2025, security was a hot topic — but it was still largely forward-looking. This year, the clock is ticking, and everyone knows it.
When the embedded community descends on Nuremberg from March 10–12 for Embedded World 2026, the conversation will feel markedly different from last year’s event. In 2025, security was a hot topic — but it was still largely forward-looking. This year, the clock is ticking, and everyone knows it.
At Embedded World 2025, our team was on the ground covering the show’s biggest themes. From SCI Semiconductor’s CHERI and CHERIOT memory safety technology to Tropic Square’s award-winning transparent secure element, from NXP’s EdgeLock 2Go platform to Infineon’s Secure SEMPER Flash — the innovations on display made one thing clear: the embedded security ecosystem is maturing rapidly.
But here’s what’s changed since last March: the EU Cyber Resilience Act timeline is no longer abstract. It’s urgent.
The September 2026 Deadline: Closer Than You Think
The CRA entered into force in December 2024, and while its full requirements don’t take effect until December 2027, the first major compliance milestone hits just six months after this year’s show. From 11 September 2026, all manufacturers of products with digital elements — including IoT devices, embedded systems, and connected consumer electronics — must report actively exploited vulnerabilities to ENISA within 24 hours.
That’s not a soft launch. It’s a mandatory reporting obligation backed by fines of up to €15 million or 2.5% of global turnover. And there’s a catch many manufacturers haven’t fully grasped yet: to report vulnerabilities, you first need to know what’s inside your products. That means having a Software Bill of Materials (SBOM), a vulnerability management process, and the infrastructure to track and respond to incidents — all of which need to be in place before September.
This makes Embedded World 2026 the last major industry gathering before the CRA reporting obligations go live. Expect it to be the dominant theme of this year’s event.
What We Expect to See at the Show
Security by Design Moves from Aspiration to Engineering Requirement
At Embedded World 2025, security by design was a principle that many exhibitors advocated for. In 2026, it’s becoming a regulatory requirement. We expect to see silicon vendors, tool providers, and security solution companies showcasing products that are explicitly designed to help manufacturers demonstrate CRA conformity — from secure boot chains and firmware encryption to hardware roots of trust and lifecycle key management.
The major silicon vendors are each approaching this challenge with their own security architectures, and we expect all of them to feature prominently at the show. STMicroelectronics‘ Secure Firmware Installation (SFI) capability, built into their STM32 MCU family as part of the broader STM32Trust ecosystem, enables the secure installation of OEM firmware even in untrusted production environments such as contract manufacturing facilities. SFI protects against unauthorised access, firmware disclosure, and overproduction — all critical concerns as the CRA places responsibility squarely on manufacturers for the security of their entire supply chain. Devices like the STM32H573, which comes pre-certified with a SESIP Level 3-compliant secure manager and pre-provisioned x509 certificates, are designed to significantly ease the path to CRA compliance.
Renesas, meanwhile, continues to build out the security capabilities of its RA and RX families of microcontrollers. The RA family features integrated Secure Crypto Engines (SCE9, SCE7, SCE5) that provide hardware-based secure boot, key management, and cryptographic acceleration directly on-chip. Renesas also offers a Device Lifecycle Management (DLM) server for managing cryptographic key injection during production and field updates, alongside their encrypted key wrapping service for securely provisioning keys into devices. For manufacturers who need security built into the silicon rather than added as a discrete component, the RA and RX families offer a compelling, integrated approach.
NXP, with whom EPS Global partners on EdgeLock 2Go provisioning, will likely expand on the platform’s ability to handle secure device onboarding and credential management at scale. For manufacturers wrestling with how to provision security credentials into millions of devices, this kind of infrastructure is moving from “nice to have” to essential.
Memory Safety Gets Serious
One of the most striking presentations at Embedded World 2025 came from SCI Semiconductor, where Haydn Povey demonstrated how CHERI-enabled ICENI devices can address the memory safety vulnerabilities responsible for roughly 70% of critical exploits in embedded systems. Since last year’s show, EPS Global has become a strategic distributor for SCI Semiconductor’s ICENI family, bringing these CHERI-enabled devices to critical industries. Visitors to Embedded World 2026 can see these technologies in action at SCI Semiconductor’s booth in Hall 4A, Booth 4A-131.
We expect memory safety to feature prominently again in 2026. With software supply chain vulnerabilities accounting for up to 90% of CVEs in some designs, hardware-enforced compartmentalization isn’t just a technical curiosity — it’s a practical answer to one of the industry’s most persistent security challenges.
Secure Provisioning and Manufacturing Security Take Centre Stage
The CRA doesn’t just care about how a product is designed. It cares about how it’s manufactured. Firmware that is encrypted in development but shipped without proper provisioning is still vulnerable. The manufacturing process itself — the point at which software meets silicon — is a critical link in the security chain.
This is exactly where EPS Global operates. Our secure provisioning services ensure that firmware is encrypted, device identities are unique, and keys are injected using tamper-proof Hardware Security Modules in ISO 27001-certified facilities. Whether the solution involves IAR’s ESecIP for microcontroller-agnostic firmware encryption, NXP’s EdgeLock for secure element provisioning, or Tropic Square’s transparent secure element, the provisioning step is where security moves from theory to practice.
At Embedded World 2026, we’ll be demonstrating how manufacturers can integrate these capabilities into their existing production workflows — without redesigning their products from scratch.
Post-Quantum Readiness Enters the Mainstream
At Embedded World 2025, NXP unveiled the S32K5 automotive MCU with a post-quantum cryptography (PQC)-ready security engine. This year, expect the PQC conversation to expand well beyond automotive. As the CRA requires manufacturers to maintain security throughout a product’s lifecycle, and many embedded devices have operational lifetimes measured in decades, the question of whether today’s encryption will hold up against tomorrow’s quantum threats is becoming a product design consideration, not just a research topic.
Edge AI Meets Security
Artificial intelligence at the edge was one of the four dominant themes at Embedded World 2025, alongside connectivity, cybersecurity, and edge computing. In 2026, we anticipate growing interest in how AI can enhance embedded security itself — from anomaly detection on constrained devices to AI-driven vulnerability analysis. At the same time, the security of AI models running on edge devices will be a new area of concern: if the model is valuable IP, it needs the same level of protection as any other firmware asset.
Looking Ahead: What 2026 Means for the Industry
Embedded World 2026 arrives at a pivotal moment. The embedded industry is transitioning from an era where security was optional — something added if there was time and budget — to one where it’s mandated by law and enforced with teeth.
For manufacturers, the message is clear: start now. The September 2026 reporting deadline is the first gate, but it won’t be the last. The full CRA requirements in December 2027, combined with the UK’s PSTI Act, the Radio Equipment Directive, and sector-specific regulations in automotive and medical, are creating a compliance landscape that requires a fundamentally different approach to product development and manufacturing.
The good news is that the ecosystem is ready. The partnerships between silicon vendors, security tool providers, and provisioning specialists like EPS Global mean that manufacturers don’t have to solve these challenges alone. The solutions demonstrated at Embedded World 2025 are now production-ready, and the show floor in Nuremberg this March will be the proving ground.
EPS Global will be at Embedded World 2026, March 10–12 in Nuremberg. Visit us to see live demonstrations of secure provisioning and to speak with our team about how to prepare your products for CRA compliance. Contact us to schedule a meeting at the show.
Read our coverage from Embedded World 2025:
