The EU CRA Readiness for Contributors and Maintainers : A Survival Toolkit

on YouTube ↗53m

" summary

EU Cyber Resilience Act is already in force (Dec 2024) with September 2026 reporting for vulnerabilities and full obligations from December 2027; free open source that is not commercial stays out of scope but projects that accept money or ship binaries may trigger requirements. Manufacturers must provide 5 year support and retain docs 10 years, produce conformity/C-marking, do due diligence on OSS and publish SBOMs; tooling and frameworks mentioned include OpenSSF scorecards, Guac/Trustify and OSCAL to automate evidence and continuous compliance.

AI-written summary · about

" chapters (26)

1. 0:00EU CRA introduction
2. 1:16CRA scope and categories
3. 3:40Products with digital elements
4. 6:06CRA out of scope
5. 7:31Open source exclusions
6. 10:21Roles and responsibilities
7. 13:12Manufacturers and open source
8. 15:19CRA timeline and deadlines
9. 16:42Who CRA affects
10. 19:35Manufacturer obligations and fines
11. 22:06CRA standards and efforts
12. 24:17Why open source cares
13. 25:21Open source challenges
14. 26:25Voluntary security attestations
15. 28:32CRA for open source projects
16. 30:19CRA guidance resources
17. 32:47OpenSSF tools for CRA
18. 34:13Open Source Product Security Baseline
19. 37:03Security Insights specifications
20. 39:30Open source sustainability
21. 41:15Advice for maintainers
22. 43:25Maintainer security posture
23. 44:54Automating CRA practices
24. 47:02Continuous compliance tools
25. 49:36CRA benefits for security
26. 50:18Key takeaways and next steps

" related talks

• 33mImplementing the EU Cyber Resilience Act (CRA)Mirko Böhm · FOSS Backstage 2025
• 32mHow to stay compliant with and take benefits from the EU CRA (Cyber Resilience Act)Roman Zhukov · DevConf.CZ 2025
• 42mMaking EU CRA (Cyber Resilience Act) simplified and non-scary for OSS contributorsRoman Zhukov · Øredev 2025
• 53mHow To Stay Compliant With and Take Benefits From the EU CRA (Cyber Resilience Act)Roman Zhukov · Open Source Summit North America 2025
• 46mLinux Foundation Initiatives Supporting the Implementation of the EU Cyber Resilience ActHilary Carter, Christopher R Robinson, Mirko Boehm · Open Source Summit Europe 2025
• 22mEU Cyber Resilience Act - A Product Owner’s ApproachLangley Rock · CVE/FIRST VulnCon 2025
• 42mMaking EU CRA (Cyber Resilience Act) Simplified and Non-scary for OSS ContributorsRoman Zhukov · Open Source Summit North America 2025
• 30mThe EU's Cybersecurity Resilience Act (CRA) has Begun – How Can Manufacturers Confidently Addres ...Mars Cheng · FIRST Conference 2026 (FIRSTCON26)