When Software Grows a Legal Spine: Inside the EU’s Cyber Resilience Act
For years, building secure software in Europe meant following your own conscience — or your customer’s contract. You could ship a container image with no software inventory, patch vulnerabilities on whatever schedule suited you, and disclose flaws only if you felt like it. Good teams did better than that anyway, because it was good engineering. But nothing in EU law forced anyone to. The Cyber Resilience Act (CRA) changes that calculus: it takes practices security-conscious teams already knew were “best practice” and turns them into conditions for selling a product in Europe at all.