Your device will outliveits cryptography.

Yes, for two reasons. First, harvest-now-decrypt-later: encrypted data intercepted today can be stored and decrypted once quantum computers mature, so data with a long confidentiality lifetime is already at risk. Second, device lifecycles: a device shipping today on RSA or ECC will still be in service past the 2030 and 2035 milestones in NIST's transition timeline.

Often yes. Options range from optimized software implementations of the NIST algorithms on constrained targets, to secure-element add-ons, to redesign. The right answer depends on the device class, and that is exactly what the gap assessment determines.

PraQtic uses a decision framework built on the device's resources, field-update capability, remaining lifecycle, and regulatory exposure. Most fleets end up with a mix.

Products covered by the EU MDR or IVDR are excluded from the CRA's product requirements, but the exemption follows the product, not the company, and exempt does not mean unaffected. Companion apps and other non-MDR digital products fall fully under the CRA, standalone components can be in scope, suppliers' CRA vulnerability reports feed the manufacturer's own MDR post-market surveillance duties, and the MDR itself demands state-of-the-art cybersecurity, with a Commission proposal on the table to add CRA-style vulnerability reporting to the MDR. PraQtic helps determine which regime applies to each product and builds the evidence each one requires.

From 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents: an early warning within 24 hours and a full notification within 72 hours, via ENISA's Single Reporting Platform. This covers products already on the EU market. The CRA's full requirements apply from 11 December 2027.

Most consultancies stop at the report and most PQC tools stop at the network. PraQtic works at the firmware level and executes the migration.

A cryptography bill of materials: an inventory of every algorithm, key, certificate, and protocol in a product. It is the starting point of any migration and increasingly expected by regulators. PraQtic builds it using the CycloneDX standard.