The live-event industry has just crossed an important cybersecurity milestone. From 11 September 2026, the European Union’s Cyber Resilience Act (CRA) requires manufacturers to report actively exploited vulnerabilities and severe security incidents affecting products with digital elements. An early warning is due within 24 hours of becoming aware of the issue, followed by a fuller notification within 72 hours through the EU’s Single Reporting Platform.
Most of the CRA’s product-security requirements do not apply until 11 December 2027, but the reporting phase is already live. For event professionals, that matters because modern productions increasingly depend on networked products: lighting consoles, Ethernet/DMX gateways, network nodes, intelligent fixtures, media servers, processors, show-control systems, remote-management tools and other devices whose behaviour depends on software and connectivity.
The timing is especially relevant after PLASA Show 2026. Cybersecurity moved from a specialist discussion to a visible industry theme, while Sig-Net—a secure communication framework for entertainment lighting networks—received a PLASA Award for Innovation. Together, the regulatory milestone and the industry response point in the same direction: cyber resilience is becoming part of technical production design, not only an IT concern.
What changed on 11 September 2026?
The Cyber Resilience Act is Regulation (EU) 2024/2847. It introduces horizontal cybersecurity requirements for products with digital elements placed on the European market. Its main provisions apply from 11 December 2027, but Article 14 reporting obligations became applicable on 11 September 2026.
According to the European Commission, manufacturers must now report actively exploited vulnerabilities and severe incidents affecting the security of their products. The process starts with an early warning within 24 hours and a full notification within 72 hours. For actively exploited vulnerabilities, a final report is required no later than 14 days after a corrective measure becomes available; for severe incidents, the final report is due within one month of the 72-hour notification.
These reports are submitted through the CRA Single Reporting Platform established by ENISA and operational since 11 September 2026.
For technical directors, the key distinction is important: the CRA primarily creates obligations for manufacturers and other economic operators, not for a freelance technical director simply operating equipment on a show. However, the products we specify, rent, integrate and depend on will increasingly be designed, documented and supported within this regulatory framework.
Why live-event technology is directly concerned
Event technology has spent years moving from isolated point-to-point systems toward software-defined, IP-based ecosystems. Lighting networks routinely carry sACN, Art-Net and RDM data. Audio, intercom, video, tracking, automation and monitoring increasingly share Ethernet infrastructure. Media servers communicate with render nodes, controllers and cloud services. Manufacturer configuration applications often connect laptops, tablets or phones directly to devices on the show network.
This creates huge operational benefits, but it also means that the traditional assumption of a permanently closed, trusted production network is becoming less realistic.
A fashion show, brand activation or large entertainment production may combine equipment from several rental companies, venue IT, temporary Wi-Fi, remote support, content-transfer machines and client infrastructure for only a few days. A network can therefore be physically temporary while still having many potential trust boundaries.
The CRA changes the context in which manufacturers have to design these products. The regulation includes requirements around cybersecurity risk, vulnerability handling, security updates and lifecycle support. It also reinforces the idea that products should be secure by design and by default rather than relying entirely on the integrator to create security around them.
PLASA 2026 shows where lighting networks may be heading
The entertainment-lighting industry is already reacting. PLASA created a dedicated CyberFest in early September 2026 to give developers and system engineers a practical environment for testing Sig-Net, SNOW and file-transfer protocols, explicitly positioning the event as preparation for the Cyber Resilience Act.
At PLASA Show 2026, Sig-Net then received a PLASA Award for Innovation. The judging panel described the collaborative framework as a potential cornerstone of cybersecurity in the lighting industry and highlighted early manufacturer adoption as a way to prepare the sector for CRA requirements.
What is Sig-Net?
Sig-Net is a free, royalty-free communication framework designed for entertainment lighting networks. PLASA describes it as a security layer capable of transporting familiar entertainment-control functions—including DMX, RDM, timecode and firmware-related workflows—inside a more secure framework.
That distinction matters. Existing protocols such as Art-Net and sACN were created primarily for reliable real-time control inside trusted production environments. Authentication and cryptographic trust were not central design assumptions. Sig-Net is one attempt to introduce those concepts without asking the industry to abandon every existing control workflow at once.
It should not be treated as a magic compliance badge. Using one secure protocol does not by itself make a product or an entire production CRA-compliant. Product security also involves software maintenance, vulnerability handling, update mechanisms, access control, documentation and the manufacturer’s overall risk-management process. Nevertheless, the rapid attention around Sig-Net is a useful indicator of how entertainment networks are evolving.
Five changes technical directors should make now
1. Add cybersecurity questions to equipment specification
When comparing consoles, nodes, gateways, processors or media-server components, technical specifications should no longer stop at universes, ports, bandwidth and redundancy. Ask manufacturers and suppliers about the product’s security-update policy, expected support period, vulnerability-disclosure contact, authentication options and roadmap toward CRA requirements.
For long-life installations or equipment intended for repeated rental use, lifecycle support may become as important as raw processing capacity.
2. Design show networks with explicit trust boundaries
Segmentation already makes technical systems easier to troubleshoot. It also limits the effect of a compromised or misconfigured device. Lighting control, media servers, Dante or other audio-over-IP systems, NDI/ST 2110 video, production Wi-Fi, venue services and general internet access should not automatically exist in one unrestricted broadcast domain simply because Ethernet makes that possible.
VLANs, routing rules and clearly controlled gateways turn the network diagram into part of the production’s resilience plan. The objective is not to make a temporary show network behave like a bank; it is to ensure that each connection has a reason to exist.
3. Treat firmware versions like show-file versions
Production teams are usually disciplined about backing up lighting files, media-server projects and playback content. Firmware is often tracked less rigorously. That needs to change.
For critical systems, record approved firmware and software versions before load-in. Keep installation packages where licensing permits, document when updates are applied and avoid last-minute upgrades without a rollback path. A security update is important, but so is operational stability: the correct production workflow balances both.
4. Add cyber incidents to the escalation plan
A show-stop procedure normally covers power loss, network failure, playback failure and equipment replacement. It should also cover suspicious network behaviour or a newly disclosed vulnerability in a critical device.
The production file should identify who can isolate a network segment, who has vendor support contacts, where clean configuration backups are stored and what the fallback operating mode is. On a major show, the worst time to decide who owns a cybersecurity problem is after doors have opened.
5. Evaluate resilience across the complete temporary system
The regulatory status of individual products is only one layer. Event productions are systems assembled from many products for a short period of time. A secure console connected to an unmanaged switch, an unknown laptop and an unrestricted wireless bridge can still create a fragile environment.
Technical direction therefore has to evaluate the system architecture: network topology, credentials, remote-access paths, backups, spare hardware, configuration control and recovery time.
Why this matters particularly in luxury and fashion production
Luxury and fashion events combine several characteristics that make this topic especially relevant: high confidentiality, compressed installation schedules, temporary venues, large quantities of networked AV equipment, multiple suppliers and strong dependence on precise time-coded execution.
A runway show may contain lighting control, media servers, cameras, tracking, automation, comms and client networks inside the same temporary building. A product launch may require remote content updates shortly before doors. A high-jewellery presentation can involve highly sensitive unreleased imagery and confidential guest information in parallel with the technical infrastructure.
In these environments, cybersecurity should not become a separate bureaucratic layer. The useful approach is to integrate it into existing technical-direction disciplines: signal flow, redundancy, access control, documentation and rehearsed failure modes.
What this means for event production
The immediate takeaway is not that productions suddenly need a cybersecurity department. It is that the definition of a reliable show system is expanding.
For years, technical directors have designed around failure: redundant playback, backup consoles, dual network paths, spare fibre, UPS systems and recovery procedures. Cyber resilience follows the same logic. The question is no longer only, “What happens if this component fails?” but also, “What happens if this component is running vulnerable software, receives an unauthorised command, loses trust with another device or needs an urgent security update?”
The CRA will accelerate changes inside the products that reach rental inventories over the next two years. Secure communications, authenticated devices, controlled firmware distribution and clearer manufacturer support policies are likely to become normal selection criteria alongside latency, output count and interoperability.
Technical directors do not need to become cybersecurity specialists. But they do need enough understanding to ask the right questions, create clear boundaries and make sure a production can still operate safely when a digital component behaves unexpectedly.
The 2027 deadline is closer than it looks
September 2026 is the first operational CRA milestone, not the end of the transition. The main requirements apply from 11 December 2027. For manufacturers, that leaves a little over a year to complete product, process and documentation changes. For production companies and rental houses, it is a useful window to start looking at inventory and purchasing decisions through a cybersecurity lens.
PLASA’s focus on CyberFest, secure networking and Sig-Net suggests that entertainment technology is already moving in that direction. The most useful response for production teams is therefore practical rather than alarmist: improve documentation, design intentional networks, understand vendor support and treat digital security as one more layer of show reliability.
Sources and further reading
European Commission — Cyber Resilience Act: reporting obligations
EUR-Lex — Regulation (EU) 2024/2847
European Commission — Cyber Resilience Act overview
PLASA — CyberFest / PlugFest 2026
PLASA — Sig-Net and the future of lighting networks
ETNow — PLASA Awards for Innovation 2026
