When the EU Cyber Resilience Act (CRA) was introduced into law in 2024, it represented one of the most significant regulatory shifts we've seen anywhere in the world with implications for how organizations build, ship, and maintain software. It establishes cybersecurity requirements for hardware and software products sold within the European Union or produced by organizations operating in the EU, and is among the first international legislation focused on cybersecurity requirements. It was also part of a wave of global regulations that put the security of software supply chains in the spotlight.
