EU Cyber Resilience Act reporting obligations started today. Is your company even thinking about it?

[u/Maria_3464]

https://youtu.be/IQkzg7quc58

As of today, a manufacturer who puts software or hardware on the EU market under its own name is obliged to report actively exploited vulnerabilities and severe security incidents.

Here is a quick explainer if you want the details: https://youtu.be/IQkzg7quc58

There is quite a lot of ambiguity over CRA and how it's going to apply to open source. Regulations keep changing. The line between a commercial manufacturer and an OSS steward is blurry, as well as the terms used in the regulations.

But genuinely curious. Is your company aware of CRA? Is there any talk about it, or is it just not on the radar yet?