The Cyber Resilience Act (CRA) is a cyber-security regulation for the EU proposed on 15 September 2022 by the European Commission for improving cybersecurity and cyber resilience in the EU through common cybersecurity standards for products with digital elements in the EU. Multiple open source organizations have criticized CRA for creating a "chilling effect on open source software development". Products with digital elements mainly refer to hardware and software, including products whose "intended and foreseeable use includes direct or indirect data connection to a device or network".

Purposes and motivations 
The background, purposes and motivations for the proposed policy include:
 Consumers increasingly become victims to security flaws of digital products (e.g. vulnerabilities), including of Internet of Things devices or smart devices.
 Ensuring that digital products in the supply chain are secure is important for businesses, and cybersecurity often is a "full company risk issue".
 Potential impacts of hacking include "severe disruption of economic and social activities across the internal market, undermining security or even becoming life-threatening".
 Cybersecurity-by-design and by-default principles would impose a duty of care for the lifecycle of products, instead of e.g. relying on consumers and volunteers to establish a basic level of security. The new rules would "rebalance responsibility towards manufacturers".
 Cyberattacks have led "to an estimated global annual cost of cybercrime of €5.5 trillion by 2021".
 The rapid spread of digital technologies means rogue states or non-state groups could more easily disrupt critical infrastructures such as public administration and hospitals.
 The CRA could make the EU a leader on cybersecurity and "change the rules of the game globally".

Implementation and mechanisms 
Once the law has passed, manufacturers would "have a grace period of two years to adapt to the new requirements" and one year for "vulnerability and incident reporting". Failure to comply "could result in fines of up to $15 million (€15 million) or 2.5 percent of the offender's total worldwide annual turnover for the preceding financial year". The policy requires that products' default settings should be that security updates are rolled out automatically by-default, while allowing users to opt out. Companies need to conduct cyber risk assessments before a product is put on the market and throughout its lifecycle effectively manage its vulnerabilities, regularly test it, and so on. Products assessed as 'critical' will need to undergo external audits. Companies would have to notify EU cybersecurity agency ENISA of any incidents within 24 hours of becoming aware of them, and take measures to resolve them. Products are categorized via two classes of risks. Products carrying the CE certifications would meet a minimum level of cybersecurity checks.

Euractiv has reported on novel drafts or draft-changes that includes changes like the "removal of time obligations for products' lifetime and limiting the scope of reporting to significant incidents". The first compromise amendment will be discussed on 22 May 2023 until which groups reportedly could submit written comments. Euractiv has provided a summary overview of the proposed changes.

The main political groups in the European Parliament are expected to agree on the Cyber Resilience Act at a meeting on July 5, 2023. Lawmakers will discuss open source considerations, support periods, reporting obligations, and the implementation timeline. The committee vote is scheduled for July 19th, 2023.

The Spanish presidency of the EU Council has released a revised draft  that simplifies the regulatory requirements for connected devices. It would reduce the number of product categories that must comply with specific regulations, mandate reporting of cybersecurity incidents to national CSIRTs, and include provisions for determining product lifetime and easing administrative burdens for small companies. The law also clarifies that spare parts with digital elements supplied by the original manufacturer are exempt from the new requirements.

The Council text further stipulates that prior to seeking compulsory certification, the European Union executives must undertake an impact assessment to evaluate both the supply and demand aspects of the internal market, as well as the member states' capacity and preparedness for implementing the proposed schemes.

Criticism 
 Multiple open source organizations like The Eclipse Foundation and The Document Foundation have signed the open letter "Open Letter to the European Commission on the Cyber Resilience Act", asking policy-makers to change the under-representation of the open source community. It finds that with the policy "more than 70% of the software in Europe [open source/FOSS] is about to be regulated without an in-depth consultation" and if implemented as written (as of April) would have a "chilling effect on open source software development as a global endeavour, with the net effect of undermining the EU's own expressed goals for innovation, digital sovereignty, and future prosperity".
 Although Mozilla "welcome[s] and support[s] the overarching goals of the CRA", it also criticised proposal for unclear text ‘commercial activity’, misalignment with other EU rules, and requirement of disclosure of the unmitigated vulnerabilities.
 A technology expert argued the CRA's "underlying assumption is that you can just add security to software" with "[m]any open source developers hav[ing] neither the revenue nor resources to secure their programs to a government standard". Another tech journalist noted that "there's some problematic language with how the CRA draws a line between commercial and non-commercial [open source software] use, which could hurt the future of open source." The OSI found that the text as of January 2023 would cause extensive problems for open source software, arising from "ambiguities in the wording and a framing which does not match the way Open Source communities actually function and their participants are motivated" and submitted information about such issues to the European Commission's request for input.
 CCIA Europe warned that "the resulting red tape from the approval process could hamper the roll-out of new technologies and services in Europe".

See also 
 Artificial Intelligence Act
 Consumer protection
 Cyber self-defense
 List of data breaches
 List of security hacking incidents#
 Sustainable design
 Standardization

References

External links 
 

Data laws of Europe
Computing legislation
Open digital policy proposals
Computer security
Internet of things
IT infrastructure