The Cyber Resilience Act, Simply Explained – Safer Software for All
The Cyber Resilience Act, Simply Explained – Safer Software for All
Software and connected devices are everywhere – in the office, in the practice and at home. With the Cyber Resilience Act (CRA), the EU is making sure such products are more secure from the start and that security holes get fixed quickly. For you as a user, that's really good news.
What does the CRA cover?
The CRA is an EU regulation that entered into force at the end of 2024 and takes effect step by step. It applies to "products with digital elements" – software and devices that connect to other devices or the internet. The key points:
- Security from the start: Products should be developed and shipped securely.
- Security updates: Manufacturers must provide updates for an appropriate period.
- Reporting obligations: Manufacturers must report actively exploited vulnerabilities and serious incidents. These obligations apply from September 2026.
- Transparency: Users should be told how long updates will be available.
The full requirements then apply from the end of 2027.
Who does the CRA affect?
The obligations are on manufacturers, importers and distributors. If you only use software or devices, you don't have to report anything. But you benefit:
- You get clearer information about updates.
- Security holes are closed faster.
- You can compare products better when buying.
And open source?
The CRA takes open source into account. Anyone who develops and shares open-source software without commercial intent generally doesn't fall under the full manufacturer obligations. Foundations and organisations that support open-source projects on an ongoing basis have their own role with lighter obligations. Many large open-source projects already have good processes for reporting and fixing security issues.
What can you actually do?
- Get an overview: Which programs and connected devices do you use?
- Turn on updates: Automatically where possible, otherwise regularly.
- Ask when buying: How long will there be security updates?
- Replace old devices: When there are no more updates, it's time for something new.
How open source helps
With open-source software like Nextcloud, Element or Vaultwarden, you can follow security notices and updates publicly. And because you decide where the software runs, updates are in your hands too – or your provider installs them for you. You'll find more alternatives under Alternatives.
A few terms, briefly explained
- Product with digital elements: Software or hardware that can be connected to other devices or networks.
- Vulnerability: A flaw in software that attackers could exploit.
- Actively exploited vulnerability: A flaw for which there are signs that it's already being used in attacks.
- Support period: The time span during which the manufacturer provides security updates.
- SBOM (software bill of materials): A parts list of the components a piece of software is made of.
What to look for when you next buy something
Whether router, printer, camera or software – a few questions help you choose:
| Question | Why it helps |
|---|---|
| How long will there be security updates? | The longer, the longer you can use the product safely |
| Do updates install automatically? | Saves work and closes gaps faster |
| Is there a contact for security reports? | Shows the manufacturer takes the topic seriously |
| Can the default password be changed? | Basic protection that sadly isn't a given everywhere |
This is especially worth checking with inexpensive connected devices – a device without updates can become the weak spot in your whole network.
Conclusion
The Cyber Resilience Act makes software and devices safer for everyone. For you, it mainly means: keep an eye on updates and ask about the support period when buying. If you'd like an assessment, have a look at Consulting.
If you'd like to give it a try, I'm happy to help – just drop me a line.
The EU AI Act for Small Businesses – Using AI at Work, Relaxed
The EU AI Act sets rules for AI. What it means for Copilot, ChatGPT and friends in everyday office work and how to approach it calmly.
Nextcloud for Small Businesses – Your Own Cloud, Simply Explained
Files, calendar and contacts in one place – on a server you know. Here's how Nextcloud works for small businesses.