The Linux Foundation

CRA Compliance: Billions in Fines, 5-Year Support Mandates & Your Software Stack

Software manufacturers worldwide are now facing mandatory vulnerability reporting deadlines, five-year support obligations, and billion-euro fines — and most have no idea what's inside their own products. The EU Cyber Resilience Act (CRA) isn't a future concern; key obligations, including vulnerability reporting, begin in September 2026, with full compliance required by December 2027. Brian Fox, Co-founder & CTO of Sonatype, and Christopher "CRob" Robinson, CTO of the Open Source Security Foundation (OpenSSF), break down exactly what CRA compliance requires, why the open source ecosystem is at the center of this regulatory storm, and what manufacturers must do right now to avoid becoming the next cautionary tale. Key Topics Covered: CRA enforcement timeline: September 2026 vulnerability reporting deadlines vs. December 2027 full compliance requirements Software Bill of Materials (SBOM) as the foundational compliance tool — including transitive dependency mapping How AI-generated vulnerability reports are flooding open source maintainers and creating a compliance bottleneck The Product Liability Directive and how it extends software accountability beyond regulatory fines to direct consumer liability Open source "commercial entanglement" — where the gray zone between exempt and in-scope software lives under the CRA Read the full story & transcript at www.tfir.io #CyberResilienceAct #CRA #SoftwareSupplyChain #OpenSourceSecurity #SBOM #Sonatype #OpenSSF #CyberSecurity #SoftwareCompliance #EURegulation