Go’s Strategic Advantage in the Era of EU Cyber Resilience and Liability
summary
EU law treats software as a product, making manufacturers liable under the revised Product Liability Directive (member states implement within two years) and imposing obligations under the Cyber Resilience Act (vulnerability reporting by mid‑2026, full compliance ~2027 with a 36‑month transition). Requirements include being free of known issues, sensible defaults, security‑by‑design, predictable update windows (expect ~5 years on average) and supply‑chain responsibility. Go-specific assets called out: reproducible builds with locked go.mod/go.sum, SBOM in every binary since 1.18, and the govulncheck tool backed by the Go vulnerability database.
AI-written summary · about
chapters (10)
- 0:00Introduction and overview
- 1:07EU legislation refresher
- 3:59Key EU laws and timelines
- 5:25Product Liability Directive explained
- 7:55Cyber Resilience Act overview
- 11:51Impact on software industry
- 13:37Scope and obligations under CRA
- 16:48Community initiatives and compliance
- 17:53Go’s strategic advantages
- 24:15Summary and call to action
related talks
25mSecure or Sorry: Your software is now a European Product
53mThe EU CRA Readiness for Contributors and Maintainers : A Survival Toolkit
59mMerging Security and Compliance: Perspectives on Emerging Regulations and Best Practices
46mLinux Foundation Initiatives Supporting the Implementation of the EU Cyber Resilience Act
22mEU Cyber Resilience Act - A Product Owner’s Approach
33mImplementing the EU Cyber Resilience Act (CRA)
33mEU cybersecurity regulation and Open Source governance
42mCopyleft and the EU CRA