The CRA, Where Are We Six Months After Its Approval
Talkat Open Source Summit Europe 2025 · on Monday, 2025-08-25· at 11:20· Elicium 2B (Elicium Level 1)·
summary
CRA is law as of late 2024 and requires a C‑mark for software, with enforcement coming end of 2027 and a vulnerability reporting obligation kicking in within about 12 months. Regulators ask for ~41 harmonization topics that the process collapses into three horizontal standards; the vulnerability handling draft draws 900 comments. Open source gets a new role, the open source software steward, mostly voluntary but expected to document sustained support; non‑stewarded projects shift compliance burden to manufacturers. Penalties reach 2.5% of global turnover, so readiness work and industry standards are urgent.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 2:34Purpose and motivation
- 6:53Impact on manufacturers
- 10:10Penalties and compliance
- 13:02CRA for open source
- 19:33Harmonized standards
- 25:19Open source challenges
- 29:32Community efforts
- 34:15Nokia’s CRA prep
- 38:38Call to action
- 39:19Q&A
related talks
36mThe CRA roadmap: What to expect
42mMaking EU CRA (Cyber Resilience Act) simplified and non-scary for OSS contributors
53mHow To Stay Compliant With and Take Benefits From the EU CRA (Cyber Resilience Act)
22mEU Cyber Resilience Act - A Product Owner’s Approach
15mKeynote: Cutting Through the Fog: Clarifying CRA Compliance in Cloud Native
32mHow to stay compliant with and take benefits from the EU CRA (Cyber Resilience Act)
01mConcerned about the CRA and how it impacts open source?
53mThe EU CRA Readiness for Contributors and Maintainers : A Survival Toolkit