The EU Cyber Resilience Act is coming, and Determinate is the missing link in your supply chainSkip to main contentFlakeHub is now FedRAMP High authorized , bringing Nix to federal agencies and their partners →<br>Get Determinate (opens in a new tab)
$refs.mobileMenu.querySelector('a, button')?.focus())" @keydown.escape.window="mobileOpen = false; $refs.mobileToggle.focus()" class="absolute inset-x-0 top-full border-t border-gray-200 bg-white dark:border-ds-border dark:bg-ds-bg lg:hidden">
The EU Cyber Resilience Act is coming, and Determinate is the missing link in your supply chain<br>LP
Luc Perkins<br>August 13, 2026·13 min read
commentarynixdeterminate-nixsecure-packagesflakebomflakeauditsbomsupply-chainsecuritycompliancecraeuropevex
The European Union’s Cyber Resilience Act (CRA) is now firmly on the horizon, with the first of two implementation stages set to begin on September 11, 2026 , just five weeks from now.<br>In that first stage, manufacturers will need to start reporting actively exploited vulnerabilities and severe incidents to European authorities on a tight 24-hour clock.<br>The rest of the regulation—the essential requirements, the conformity assessment, and the CE marking—will apply beginning December 11, 2027 .
If you sell software in the European Union, you’re now well past the point where you can safely put off thinking about the CRA.<br>And because it applies to anything in the extremely broad category of “products with digital elements,” you’ll need to be well prepared even if your company isn’t headquartered in the EU.<br>That category covers physical products just as much as software you deliver over a network: a robot, an industrial controller, or any connected device counts.<br>Most of the CRA urgency we hear about, in fact, comes from robotics companies, and for good reason, because the obligations bite hardest when your software runs on hardware that’s already out in the world.<br>We’ll have quite a bit more to say about Nix on physical devices in the near future, so watch this space.<br>In this post, however, I’d like to convince you that nothing in the CRA is truly ominous because Nix and the Determinate platform provide a comprehensive and foundationally sound solution to the software supply chain requirements that the CRA presents.
What the CRA demands
Let’s start with an in-depth look at what CRA actually involves for those who aren’t yet familiar.<br>Regulation (EU) 2024/2847 entered into force on December 10, 2024, and most of what it calls for is pretty standard security hygiene.<br>Some parts that touch on the software supply chain:
Demonstrating what’s in your product.
Annex I, Part II, point 1 requires you to identify and document the components in your product, “including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies.”<br>The Software Bill of Materials (SBOM) has to be kept current and provided to proper authorities on request.
Pay attention to the phrase “at the very least,” because top-level dependencies are the bare minimum of what SBOMs need to provide.
Shipping without known exploitable vulnerabilities.
Annex I, Part I requires products to be made available on the market (a) without any known exploitable vulnerabilities, and (b) with a secure-by-default configuration and a minimized attack surface.
Remediation without delay, for at least five years.<br>Annex I, Part II requires you to address vulnerabilities without delay and to provide security updates, while Article 13(8) sets the support period at a minimum of five years unless the product’s expected use is shorter.<br>Five years is a long time to keep a build reproducible, and the clock is especially punishing if you ship to edge or remote devices, where “provide a security update” means rebuilding an image for hardware you no longer physically control.
Due diligence even on code you didn’t write.<br>Article 13(5) requires manufacturers to exercise due diligence when integrating third-party components “so that those components do not compromise the cybersecurity of the product with digital elements, including when integrating components of free and open-source software.”
Report fast.<br>Article 14 gives you 24 hours for an early warning, 72 hours for a fuller vulnerability notification, and 14 days for a final report, filed with the European Union Agency for Cybersecurity (ENISA) and the relevant Computer Security Incident Response Team (CSIRT).<br>This is the obligation that will kick in next month (September 2026).
Getting it wrong is expensive.<br>Article 64 sets penalties for breaching the essential requirements at up to €15 million or 2.5% of total worldwide annual turnover, whichever is higher (yikes!).
There’s also an important nuance for anyone building on open source.<br>Individual maintainers and non-commercial projects are largely outside the CRA’s scope, and “open-source stewards” like foundations are subject to a lighter set of...