Grow CRA Readiness: Find Your Path Through the European Union Cyber Resilience Act

By Sally Cooper

Not sure how the EU Cyber Resilience Act (CRA) impacts your work? The OpenSSF’s new community garden user journey helps maintainers, open source software stewards, and manufacturers find their unique path to understanding the CRA. This resource provides a simple way to identify your specific role, navigate legal requirements, and access the tools, training, and community support necessary to maintain compliance and keep software secure.

Across the community, people are asking questions about the EU Cyber Resilience Act: Where do I fit? What do I need to do? Where can I find information that applies to my role? 

That is why OpenSSF created Grow CRA Readiness: A Community Garden Journey with OpenSSF. It gives people a simple way to identify their role and move directly to the guidance, tools, and community support that can assist them.

What is the EU Cyber Resilience Act, and why does it matter now?

The EU Cyber Resilience Act introduces cybersecurity requirements for many hardware and software products made available on the EU market.

The first major deadline arrived on September 11, 2026, when reporting obligations for manufacturers began. The broader requirements apply beginning December 11, 2027. A good start in understanding is to know your role and where to find reliable guidance.

How can open source communities prepare for the CRA?

Many people are still unsure how the CRA applies to their work. The 2026 CRA Awareness and Readiness Report found that 66% of respondents were unfamiliar with the regulation.

That is why OpenSSF went all in on Policy and CRA alignment as a focus in its 2026 community roadmap. Working with the Global Cyber Policy Working Group and its Awareness SIG, the community helped to create this journey, podcasts, Tech Talks, guides, and other materials to help people find their role and take the next step.

How can I understand the different CRA roles? The community garden analogy