The CRA Challenge: Can Open Source and IoT Stay Agile Under Regulation?
summary
Discussion names concrete pain points and fixes: lack of scalable risk‑assessment tooling, reliance on SBOMs to inventory hidden libraries, and industry pressure to guarantee 9‑year support promises for embedded stacks. Examples include using open foundations to share maintenance load, manufacturers refusing responsibility for drivers that integrators don’t write, and attestation costing tens of thousands rather than hundreds of thousands. Claims: collaboration reduces cost; unresolved: legal liability for discontinued software and who must pay ongoing patching.
AI-written summary · about
chapters (13)
- 0:00CRA challenge panel intro
- 0:45Bosch’s CRA compliance prep
- 2:33Risk assessment under CRA
- 4:01Open source response to CRA
- 6:52Industry compliance challenges
- 9:22CRA impact on innovation
- 11:28Open source long-term support
- 12:51Balena’s sustainability concerns
- 14:13CRA compliance costs
- 15:56CRA security benefits
- 18:25Open source project impacts
- 20:13Open source feedback loops
- 21:39Final CRA statements
related talks
42mPanel Discussion: The Impact of the CRA on the Open Source Ecosystem
44mPanel Discussion: Prepare for the CRA: Open Source Governance in the Age of Cyber Resilience
27mBeyond Open Source Risks With the CRA and NIS2
34mHow Community Collaboration is Fixing the Future of Tech Regulation
31mPanel Discussion: Open Source Enabling Industrial Innovation
45mRegulated and Sovereign : Impact to the Open Source Developer
14mThe CRA: an Open Source Sustainability law?
29mSponsored Session: Who Will Move Your Cheese ? IEC, CRA, Cyber Security