The EU Cybersecurity Resilience Act (CRA) - Boring, Scary or Exciting?
summary
Companies that sell products with digital elements in the EU are manufacturer, steward, maintainer in different legal roles: maintainers have no obligations, stewards offer support but little liability, manufacturers carry duties. Core obligations are risk assessment, vulnerability and incident management, dependency tracking and conformance testing based on product class, with vulnerability/incident rules effective earlier and full CRA compliance by December 2027. Products require five years of free-security updates after last substantial change; enforcement can include fines up to about 2–2.5% of global turnover.
AI-written summary · about
chapters (11)
- 0:00EU Cybersecurity Resilience Act intro
- 1:05Manufacturer or steward definition
- 5:00Products with digital elements
- 9:37Why the EU created the CRA
- 10:59CRA compliance deadlines
- 12:45Core CRA obligations
- 17:53Your role in ecosystem
- 22:06Open source incentives
- 25:59Steps to CRA compliance
- 27:45CRA boring, scary or exciting?
- 28:47Q&A on definitions
related talks
30mThe EU's Cybersecurity Resilience Act (CRA) has Begun – How Can Manufacturers Confidently Addres ...
27mEU Cyber Resilience Act: What Every Manufacturer Needs to Know
53mHow To Stay Compliant With and Take Benefits From the EU CRA (Cyber Resilience Act)
33mImplementing the EU Cyber Resilience Act (CRA)
44mThey're coming to regulate you!
39mCherry Blossom and Compliance - An Intro To the EU CRA
32mHow to stay compliant with and take benefits from the EU CRA (Cyber Resilience Act)
42mMaking EU CRA (Cyber Resilience Act) Simplified and Non-scary for OSS Contributors