Executive Summary: What is it?
The EU Cyber Resilience Act (CRA) is a regulation that sets mandatory cybersecurity requirements across a product's whole lifecycle. It applies to hardware and software products with a data connection that are sold or otherwise supplied in the EU in the course of a commercial activity. Products covered by sector rules (such as medical devices, motor vehicles and certified aviation products) are excluded, and so is open-source software that is not monetised. Software sold as a service falls outside it (NIS2 covers cloud services), unless the service is the remote back end a covered product needs to work. Most obligations apply from 11 December 2027.
CFO / Business Impact: What does it cost/risk?
- Legal Responsibility: A company that monetises software it places on the EU market is a manufacturer with the full obligations. An open-source software steward, such as a foundation, has light duties (a security policy, cooperation with authorities and, where it takes part in development, reporting exploited vulnerabilities) and faces no administrative fines.
- Transparency: Every manufacturer must keep a software bill of materials (SBOM). The law does not oblige the manufacturer to hand it to customers, so a buyer who needs it makes access a contract term.
Technical Reality: How does it work?
- SBOM: The manufacturer draws up a software bill of materials in a commonly used, machine-readable format that covers at least the top-level dependencies. It goes to market surveillance authorities on request; publishing it to users is optional.
- Reporting: Since 11 September 2026, a manufacturer must report an actively exploited vulnerability through the EU single reporting platform: an early warning within 24 hours of becoming aware of it, a notification within 72 hours, and a final report within 14 days of a fix or mitigation being available. A severe incident affecting the product's security runs on the same 24- and 72-hour clocks, with a final report within one month.
What the Label Means in a Solution Profile
- Self-Hosted line: "CRA Ready" is this hub's label, not a legal status: no law defines it. It means the project's own releases ship what a company supplying the software commercially in the EU needs to meet its duties: SBOMs, a disclosure policy, public advisories, security releases, a published support policy and signed artifacts. Its free self-hosted build also has the basic security controls (encryption, role-based access, audit logs and data export). Self-hosting for your own use carries no CRA duty.
- Managed service line: No managed service carries a CRA label. A standalone managed service is not a CRA product; NIS2 may apply to the provider instead.