Home / All essays / Tags / Cyber Resilience Act

Cyber Resilience Act

The CRA from the side of those who make software: 24-hour early warning, SBOMs, and a maturity score that is not proof of conformity.

From 11 September 2026, Article 14 of the Cyber Resilience Act requires an early warning within 24 hours for exploited vulnerabilities, and there will be no dress rehearsal. The CRA interests me because it is the most concrete rule in the European package: SBOMs, vulnerability handling, updates for the whole life of the product are things a team either can do or cannot. A maturity score is not conformity, a questionnaire is not an inventory. I write about what is actually needed, before the deadline.

13.08 2026
№ 82

CRA Compliance ENISA NIS2 Software Development EU Regulation

No Dress Rehearsal

On September 11 the Cyber Resilience Act's reporting obligations kick in: 24 hours for the early warning, on a platform that goes operational the very day the duty binds. No API, no test environment, an address that isn't public yet. Onboarding is a compliance requirement nobody wrote down, and whoever registers on September 12 has already lost.

8′ reading time

1,736 words

Read →

27.07 2026
№ 81

AI AI Agents Software Development Compliance CRA Open Source

The Floor Below

Around the third month of using an agent, someone says the model has got worse. Almost always it isn't the model: it's the scaffolding, which came apart without throwing an exception. What degrades quietly is exactly what nobody is required to check, and in Europe, from September, that friction costs a non-conformity.

9′ reading time

1,816 words

Read →

17.07 2026
№ 79

CRA Compliance ENISA SME Software Development EU Regulation

A Score Is Not Proof of Conformity

An Advanced rating measures an organisation’s maturity. It does not show that a specific product conforms to the CRA. The distinction is not self-assessment versus outside scrutiny. It is diagnosis versus a declaration that carries responsibility.

10′ reading time

2,118 words

Read →

09.07 2026
№ 78

AI Act Compliance GDPR NIS2 Cyber Resilience Act EU Regulation Digital Health

Seventeen Months Are Not a Grace Period

The Digital Omnibus pushed the AI Act's high-risk obligations to 2027, and healthcare software breathed a sigh of relief. But the pressure never came from that deadline: it comes from three clocks, enforcement, engineering and the market, and none of them was touched.

9′ reading time

1,953 words

Read →

04.07 2026
№ 77

Compliance AI Act CRA PLD EU Regulation Software Development SME

Compliance Doesn't Fail for Lack of Rules, It Fails for Lack of Inventory

Five European regulations, written by different hands for different sectors, are converging on the same demand: prove you know what you have in the house. Whoever can't answer isn't non-compliant, they're ungovernable. And the inventory that's needed isn't compiled: it's generated.

7′ reading time

1,416 words

Read →

24.06 2026
№ 75

Digital Sovereignty Open Source Supply Chain Cybersecurity EU Regulation CRA Compliance

Sovereignty Doesn't Live in the Data Center

On the Cloud and AI Development Act, on the ten thousand repositories dressed up as honest projects, and on the distance between being inspectable and actually being inspected.

13′ reading time

2,976 words

Read →

01.05 2026
№ 63

Compliance PLD AI Act CRA EU Regulation

The Contract's Deception

On why the software supply contract, as we have known it, has stopped being the central instrument of the relationship between vendor and client — and how much it costs to keep pretending it still is.

19′ reading time

4.180 words

Read →

27.04 2026
№ 59

Compliance EU Regulation AI Act CRA Philosophy OF Technology Architecture Strategy

The Shape of Constraint

Treating regulatory compliance as the adversary of the technical project means you haven't understood what the technical project is. An essay on the category error weakening Europe's software industry — and on how the European framework, read as a system rather than as a list, configures a structural competitive advantage for those who learn to inhabit it.

16′ reading time

3.842 words

Read →

30.03 2026
№ 51

AI Act Compliance Cyber Resilience Act Governance

The advisory blind spot: what an IT vendor knows that an analyst doesn't

A few weeks ago I received an advisory report on IT services in our segment. It was solid, but it missed what only delivery-side vendors learn.

6′ reading time

1.365 words

Read →

← All tags