Cherry Blossom and Compliance - An Intro To the EU CRA
Talkat Open Source Summit Japan + AI_dev: Open Source GenAI & ML Summit + Automotive Linux Summit 2025 · 2025-12-08..12-10·
summary
EU Cyber Resilience Act applies to any product with software or hardware “products with digital elements” sold in the EU, becomes enforceable December 12, 2027, and raises penalties up to 2.5% global revenue plus an extra 1% for misleading documentation. Manufacturers must report exploited vulnerabilities within 24 hours and publish fixes or mitigations within 72 hours, provide SBOMs and five years of support after substantial changes, and higher‑risk classes require third‑party market surveillance audits; open source contributors have no direct obligations but an open source steward role enables project support and self‑certification.
AI-written summary · about
chapters (11)
- 0:00EU CRA introduction
- 2:29What is EU Cyber Resilience Act
- 5:43Penalties for non-compliance
- 8:16Products covered by CRA
- 11:52Compliance levels and categories
- 13:41Certification process framework
- 17:38Manufacturers' responsibilities
- 21:54CRA enforcement timeline
- 25:03Vulnerability reporting rules
- 28:55Open source and CRA impact
- 33:08Compliance resources and next steps
related talks
27mEU Cyber Resilience Act: What Every Manufacturer Needs to Know
53mHow To Stay Compliant With and Take Benefits From the EU CRA (Cyber Resilience Act)
44mThey're coming to regulate you!
32mHow to stay compliant with and take benefits from the EU CRA (Cyber Resilience Act)
30mThe EU's Cybersecurity Resilience Act (CRA) has Begun – How Can Manufacturers Confidently Addres ...
22mEU Cyber Resilience Act - A Product Owner’s Approach
32mThe EU Cybersecurity Resilience Act (CRA) - Boring, Scary or Exciting?
31mCopyleft and the EU CRA