The Cyber Resilience Act never says 'sign your images', but it requires integrity protection for programs, secure distribution of updates and due diligence on components, and signatures are the practical way to show all three. A Cosign walkthrough for container images: key-based or keyless, what ends up in the public transparency log, attaching the SBOM as an attestation, and the verification mistake that makes a signature worthless.
Article 14 sets the minimum content of each CRA notification; ENISA's reporting platform turns it into 39 fields, only a handful of them mandatory at 24 hours. This is a stage-by-stage template that maps the legal text to the platform's fields, including the two optional fields that decide whether a CSIRT may hold your notification back.
One page that walks a software company through the Cyber Resilience Act in the order the questions come up: are you a manufacturer, what applies already, what applies from December 2027, how conformity is shown, and how NIS2 customers fit in. Each section is short and links to the clause-by-clause post and the article text behind it.
De Cyber Resilience Act is een verordening en geldt rechtstreeks, maar wie in Nederland wat doet, regelt de Uitvoeringswet verordening cyberweerbaarheid: door de Tweede Kamer aangenomen op 10 september 2026 en nu bij de Eerste Kamer. Melden doe je sinds 11 september bij het NCSC, via MijnNCSC of een formulier zonder account. Het toezicht ligt bij de RDI. Dit is wat dat in de praktijk betekent voor een Nederlandse softwarefabrikant.
Standalone SaaS is not a product under the Cyber Resilience Act; it sits under NIS2 if the provider is medium-sized or larger. But the moment a SaaS company ships a mobile app, desktop client, agent or self-hosted edition, the backend that product depends on can become a remote data processing solution, and with it part of the product: in the risk assessment, under Annex I and in Article 14 reporting, which already applies. The Commission's July 2026 guidance gives the test.
The Cyber Resilience Act asks for less in an SBOM than most teams assume: top-level dependencies at minimum, a commonly used machine-readable format, no obligation to publish, and no mandated format yet. It applies from 11 December 2027. Customers under NIS2 will ask for more, which is why one SBOM per build, bound to the artifact, beats chasing a single file that satisfies everyone.
Article 13(8) makes every manufacturer decide, document and publish how long each product gets its vulnerabilities handled. Five years is the minimum for products used longer than that, not the answer for everyone. For software released every few months, the Commission's guidance says each substantially modified version needs its own declared period, and Article 13(10) allows patching only the latest version if upgrading is free. Reporting under Article 14 continues after support ends.
The Cyber Resilience Act regulates products; NIS2 regulates organisations. For most software companies that means the CRA applies to what they ship and NIS2 applies to the customers they ship it to, and reaches them through those customers' supply-chain duties. The two reporting regimes look alike, 24 hours, 72 hours, a final report, but they are triggered by different events and go to different places. A side-by-side reading of both texts.
Sinds 15 augustus 2026 moeten organisaties die onder de Cyberbeveiligingswet vallen geregistreerd zijn in het entiteitenregister op MijnNCSC. Voor softwarebedrijven is de eerste vraag of dat voor hen geldt: pure softwareleveranciers meestal niet, aanbieders van clouddiensten en managed services vaak wel. Dit is wat je nodig hebt om te registreren, welke gegevens het NCSC vraagt, en de fouten die je voorkomt door vooraf te weten dat je sector die van jezelf is, niet die van je klant.
NIS2 does not regulate most software suppliers, but it obliges their customers to weigh the quality of suppliers' products and their secure development procedures. For cloud and managed service providers, the Commission spelled out what that means, down to asking for the components in each product. Every questionnaire that follows comes back to four questions about a release. This is an answer kit you prepare once and point to, instead of rewriting for every customer.
De Cyberbeveiligingswet legt jou als toeleverancier geen directe verplichtingen op en er is geen toezicht op toeleveranciers. Toch verandert er iets: de zorgplicht van je klanten omvat de toeleveringsketen, dus hun verplichting bereikt jou als contractuele eis en als vragenlijst. Dit is wat ze mogen vragen, en wat je één keer kunt voorbereiden in plaats van per klant.
In July 2026 the European Commission issued two things that matter for anyone implementing the Cyber Resilience Act: an updated implementation FAQ (last updated 2 July 2026, and again on 4 September 2026) and its first official application guidance (27 July 2026). Neither changes the law, but both narrow how the Commission services read it — on scope, substantial modification, support periods and reporting.
Article 14 of Regulation (EU) 2024/2847 has bound manufacturers since 11 September 2026: 24h early warning, 72h notification and a final report, sent simultaneously to the coordinating CSIRT and ENISA. Updated for the Commission's July 2026 guidance on when a manufacturer becomes aware, and for ENISA's advice on registering with the reporting platform.
For products classified as Important Class II under Annex III, the Cyber Resilience Act blocks module A self-assessment. Module B+C or module H is mandatory — meaning a notified body must be involved before the CE mark goes on.
Article 64 of Regulation (EU) 2024/2847 creates three penalty tiers — €15M/€10M/€5M — and adds derogations for microenterprises and open-source software stewards that are commonly mis-stated. This article reads the text precisely.
Treating authentication as a feature to be added after the MVP creates architectural debt that cannot be paid without rewriting the system. For regulated environments, auth is not a feature. It is the foundation.
Disabling SSL verification to fix a certificate error during development created a production vulnerability that persisted for months. This is how small defaults become existential risks.
Container registries and artifact repositories have evolved from passive storage to active components of the software supply chain. This makes them targets for poisoning, substitution, and dependency confusion attacks.
From December 2027 the CRA makes third-country supply chain risk a binding consideration for market surveillance, and it classifies container runtimes as Class II products. This has architectural consequences for how organisations source and distribute container images.
The Cyber Resilience Act requires manufacturers to exercise due diligence on every third-party component they integrate, including open-source. Most organisations have no process for this.
The NIS2 Directive creates enforceable cybersecurity obligations for critical infrastructure operators. This article translates legal requirements into operational changes for platform teams.
Multi-tenant architectures are commonly treated as cost optimization strategies. For regulated systems, they are attack surface management problems requiring database-level isolation.
Hosting infrastructure in the EU does not automatically satisfy regulatory compliance obligations. This article explains the difference between location, control, and governance.
The CRA imposes specific technical obligations on software vendors. This article translates legal requirements into concrete engineering controls.