EU Cyber Resilience Act (CRA): Overview

The EU Cyber Resilience Act (CRA), in force since December 2024, establishes the first horizontal cybersecurity baseline for all hardware and software products sold in Europe. Key obligations include mandatory machine-readable SBOMs in technical documentation, vulnerability and incident reporting to CSIRTs and ENISA (24-hour early warning, 72-hour full notification), and security-by-design requirements. Vulnerability reporting obligations kick in September 11, 2026 — retroactively covering products already on the EU market — while full enforcement including SBOM mandates and CE marking takes effect December 11, 2027. Container images distributed commercially into the EU qualify as products with digital elements, making manufacturers responsible for image hardening, SBOM generation, provenance attestations, and defined support periods. Non-compliance can result in fines up to €15 million or 2.5% of global annual turnover. Open-source software used outside commercial activity is exempt, but organizations distributing OSS commercially are classified as manufacturers. Docker Hardened Images and Docker Scout are presented as tools to help meet these requirements.

Source: https://www.docker.com/blog/eu-cyber-resilience-act-overview. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.