Linux Foundation Education launched EU Cyber Resilience Act (CRA) for Embedded Systems (AC6403) on October 27, 2026. This intermediate, one-day course is intended for teams that design, secure, manage or assess embedded products sold in the European Union. It is not a preparation course for a new certification exam: participants receive a certificate of completion, while the practical goal is to turn CRA obligations into engineering decisions, evidence and operating procedures.
That distinction matters. AC6403 connects product classification, secure boot, updates, software bills of materials, CVE monitoring, technical documentation and conformity assessment. It is therefore more specific than a general legal briefing and more operational than a broad cybersecurity-awareness course.
AC6403 at a glance
Linux Foundation Education describes AC6403 as intermediate instructor-led training, delivered live online or in a classroom depending on the available session. The official October 27 announcement (opens in a new tab) says the course was developed in partnership with AC6 and includes a case study based on an embedded system.
| Item | Official information verified on October 30, 2026 |
|---|---|
| Code | AC6403 |
| Title | EU Cyber Resilience Act (CRA) for Embedded Systems |
| Level | Intermediate |
| Format | One instructor-led day, online or in a classroom depending on the session |
| Listed duration | One day of instructor-led class time |
| Displayed price | USD 995 |
| Included | Live class, discussions, assignments, resources and certificate of completion |
| First displayed session | December 14, 2026, 9:00–17:00 Europe/Paris, virtual |
The official AC6403 course page (opens in a new tab) also listed virtual sessions for January 25, 2027 in Europe/Paris and March 8, 2027 in US/Central. Prices and schedules can change, so candidates should recheck them before registration, especially when a company requires a particular billing currency or delivery region.
Why this course is arriving now
The regulatory timeline explains the launch. According to the European Commission’s Cyber Resilience Act page (opens in a new tab), the CRA entered into force on December 10, 2024. Reporting obligations have applied since September 11, 2026, and the main obligations will apply from December 11, 2027.
Embedded-product teams cannot wait until late 2027 to begin. They need to identify affected products, document components, organize vulnerability handling and integrate security requirements into design decisions. Those activities interact with hardware cycles, firmware releases, open-source dependencies, third-party components and the declared support period. They usually require more than a documentation update at the end of development.
AC6403 therefore sits between the start of the reporting obligations and the principal 2027 deadline. Its practical value is to help teams assign work: who maintains the inventory, who monitors CVEs, who determines whether a change is substantial, which evidence is retained and how security decisions are represented in the conformity file.
What the official outline covers
The published outline is organized around five broad blocks. The first introduces the CRA, its context, product classifications and relationship with other European legislation. The objective is not to memorize legal text. It is to determine whether a product is in scope and how its category changes the conformity path.
Essential requirements and manufacturer responsibilities
The second block addresses manufacturer responsibilities, vulnerability handling, reporting, conformity and substantial modifications. The last topic is especially relevant to embedded products: a firmware, component or architecture change can affect the risk profile and may require a new assessment.
The training should help participants ask testable questions. Does the product ship with a secure configuration? Are cryptographic keys protected? Can updates be distributed throughout the support period? Can the team distinguish an ordinary maintenance release from a change that affects the conformity evidence?
Conformity assessment and CE marking
The third block covers conformity procedures, CE marking, the distinction between important and critical products, and an embedded-system case study. Engineering teams do not replace legal counsel or a notified body, but they must provide dependable technical inputs: architecture, risk analysis, component information, protection mechanisms, tests and the rationale behind key decisions.
This perspective complements operational-technology learning. The Cisco OT Security Practitioner and 810-115 OTSEC exam guide focuses on visibility, industrial assets and operational security. AC6403 adds a European product-compliance view centered on hardware, firmware and evidence.
Security across the product lifecycle
The fourth block addresses manufacturer obligations, supply chains, third-party components, risk assessment and due diligence. For embedded products, that means knowing which versions are shipped, which open-source components are included and how a vulnerability affects every supported release.
An SBOM becomes an operational asset rather than a document generated once. It needs to stay connected to the actual firmware build and to a working monitoring process. A CVE alert alone is not enough: teams need to determine exposure, severity, compensating controls, the need for a fix and any communication or reporting obligations.
Secure boot, updates and communications
The final technical area includes key protection, secure boot, hardening, updates, automation tools, IP and TLS communications, wireless links and low-power networks. The announcement also names Yocto Project and Zephyr RTOS as environments in which teams can apply relevant security features.
The course does not claim to turn a beginner into a Yocto, Zephyr, TLS and compliance specialist in one day. Its purpose is to show how those mechanisms support one coherent argument: prevent unauthorized firmware, protect update delivery, retain evidence and reduce exposure through network interfaces.
Who should consider the course?
Linux Foundation Education lists embedded engineers, system architects, product managers, compliance engineers and test engineers as the main audience. The stated prerequisite is basic knowledge of embedded systems, including firmware, boot, updates and the product-development lifecycle. Familiarity with open-source components and basic networking is helpful.
AC6403 is likely relevant if you need to:
- sell or maintain a product with digital elements in the European Union;
- coordinate firmware, hardware, cybersecurity, quality and compliance work;
- build an actionable SBOM and vulnerability-monitoring process;
- prepare risk analysis, technical documentation or a declaration of conformity;
- define team responsibilities throughout the support period.
It is probably too specialized for someone seeking a first introduction to Linux, cybersecurity or containers. Learners who first need broader technical foundations may find the Linux Foundation YAML and Docker microlearning overview more accessible, although those modules do not cover CRA conformity.
How to prepare for the instructor-led day
One day is short. The best way to avoid an entirely theoretical experience is to arrive with a product example, even a simplified one. Before the session, prepare a short description of the hardware, firmware, update mechanism, principal libraries, network interfaces and intended support period.
Four preparatory artifacts can make the case study more useful:
- Product map: hardware and software components, associated services and supply-chain actors.
- Risk scenarios: unauthorized boot, compromised key, vulnerable dependency, failed update or exposed network interface.
- Evidence inventory: existing SBOM, test reports, disclosure policy, release history and design records.
- Governance questions: product owner, CVE-monitoring responsibility, reporting process and end-of-support decision.
After the course, convert the case-study findings into a backlog. Each gap should have an owner, expected evidence and due date. Separate technical remediation—secure boot, key rotation, encryption or hardening—from process work such as vulnerability handling, evidence retention and customer communication.
Certificate of completion or professional certification?
AC6403 is training with a certificate of completion. The official pages reviewed do not describe a proctored exam, passing score, independent professional badge or certification-validity period. It should not be presented as a new Linux Foundation certification.
For an employer, the value will depend on application to a real product. A participant can demonstrate learning by producing a defensible classification, requirements matrix, vulnerability-handling plan and evidence checklist. Those artifacts show more capability than a participation record on its own.
Is AC6403 worth the price?
AC6403 deserves attention from embedded teams that have already identified a CRA impact and need to align engineering, product and compliance work quickly. A one-day format necessarily limits technical depth, but it can establish common language and a structured starting point for longer workstreams.
Before paying USD 995, confirm that the participant has the published prerequisites and can apply the material to a concrete product. Verify the session, time zone, delivery mode and purchasing conditions. If the goal is to earn an exam-based certification, this course does not meet that need. If the goal is to build a practical CRA work plan for an embedded product, its positioning is much stronger.
