The EU Cyber Resilience Act - what you need to know

Today marks a new milestone in European cybersecurity: the Cyber Resilience Act (CRA) has been published in the EU’s Official Journal, bringing significant changes for businesses operating in the EU. But what does this mean for companies and users alike, and how is Red Hat positioned to support your needs in the new landscape?

The CRA is a robust new legislative framework aimed at enhancing the cybersecurity of (hardware and software) products with digital elements - everything from smart home devices to complex operating systems in critical national infrastructure. The CRA enters into force on 10th December 2024 and becomes fully applicable 36 months later on 11th December 2027.

The CRA mandates stringent cybersecurity requirements for in-scope products made available  in the EU, requiring manufacturers, importers and distributors to ensure comprehensive cyber resilience throughout each product’s lifecycle.

The CRA represents a step forward in protecting the digital ecosystem. By enforcing strict cybersecurity measures, the CRA ensures that products entering the EU market are safer and more resilient, which can mean fewer vulnerabilities and reduced risks for businesses and their customers. However, these rules add new responsibilities and due diligence for organisations in the EU who are using open source projects in their in-scope products.

Why the CRA matters for your business

Companies will need to ensure that in-scope products deployed in EU27 meet CRA requirements and subsequent standards. This shift calls for stronger procurement processes and verification of security benchmarks across hardware, software and supporting cloud services. For organisations relying on open source in the products that they sell on the EU27 market, the CRA means new obligations to verify the security of these components, often necessitating close partnerships with vendors that can provide enhanced support and compliance assurances.

Red Hat understands this shift and is committed to upholding open source as a driving force to optimise resilient innovation. Our role with the CRA is not just about compliance—ensuring that products like Red Hat Enterprise Linux, Red Hat OpenShift Container Platform, and Red Hat Ansible Automation Platform comply with the CRA. It’s also about continued engagement with EU policy makers as well as active participation  in European standards organisations to reflect open source best practices while continuing to advocate for the exclusion of upstream open source communities from the scope of such legislation.

Supporting open source communities

Open source powers 97% of today’s IT infrastructure, with many open source projects developed by decentralised, volunteer-driven communities. These communities may not have the resources to meet applicable CRA obligations or to maintain processes needed to support downstream compliance,  leading to fragmentation of these communities and even abandonment of vital open source projects.

Red Hat is dedicated to supporting this ecosystem. Working alongside industry leaders like Open Forum Europe, Linux Foundation, Eclipse Foundation, Open Source Initiative, Apache Software Foundation, and others, we’ve championed provisions that help safeguard upstream projects and the broader open source community from the impact of some of the more stringent compliance demands.

We believe that collaboration is vital in strengthening the open source ecosystems and we invite you to be part of this effort. Participate in upstream communities, collaborate on projects that develop tools and practices that address key CRA elements,  and choose software developed for enterprise needs built on secure, compliant open source foundations.

Our commitment to open source excellence means that organisations can rely on robust, CRA-compliant platforms without sacrificing flexibility or innovation. In a regulatory landscape increasingly focused on cybersecurity, Red Hat stands at the intersection of open source and enterprise-grade security, empowering your business to lead in a world where cyber resilience isn’t just an option—it’s essential.