Cyber Resilience Act
source: digital-strategy.ec.europa.eu
Why it is worth attention: the Cyber Resilience Act (EU Regulation 2024/2847, in force since December 10, 2024) sets security requirements on products with digital elements – reporting of exploited vulnerabilities, updates over the support period and evidence of conformity. The duty to report actively exploited vulnerabilities and severe incidents applies from September 11, 2026, the other main obligations from December 11, 2027. The direction is right: security bugs in software are a real risk that, until now, few were held responsible for.
What to take from it: the original 2022 proposal was nonetheless poorly conceived – it barely accounted for open source. The notion of “commercial” would have caught volunteer maintainers and non-profit projects too, threatening them with liability for code they give away for free. Only after pushback from the community did the final text introduce the “open-source software steward” category with limited obligations. The lesson: the goal is right, but a regulation that overlooks how open source actually comes about can harm it rather than protect it.