Obligations according to Cyber Resillience Act Regulation by EU

[hatzisn]

I am researching what are a developer's obligations according to the Cyber Resilience Act by the European Union in relation with the software I develop.

I found it very easy, discussing it with the document, in notebooklm by google. Thank God this is a life saver but in a way, it is also a threat, because it allows you to take a compressed look to what interests you directly in the document instead of reading pages over pages, but my opinion is it might miss something that would be of interest to you. You can find it at:

Google NotebookLM | AI Research Tool & Thinking Partner

Meet NotebookLM, the AI research tool and thinking partner that can analyze your sources, turn complexity into clarity and transform your content.

notebooklm.google

Doing this, through discussion I found out that according to article 71 the regulation is applied from 11 September 2027, but is valid for the obligations of article 14 of the regulation from 11 September 2026 while Chapter IV is valid from 11 June 2026. According to Google and the document the publication date of the regulation was at November 20, 2024:

"The Cyber Resilience Act (CRA) was published in the EU Official Journal on November 20, 2024. Regulation EU 2024/2847 establishes EU-wide cybersecurity requirements for the hardware and software's design, development, production, and market availability."

In the beginning it sounds overwhelming but discussing it with the document it pinpoints exactly what you have to do. Always cross check to make sure it is not hallucinating. I keep digging...

 

[rabbitBUSH]

Yikes one assumes that those future dates are the actual implementation dates provided so that operators can get stuff in order and in line for that start date, versus, the date on which the whole document was published (2024). If indeed, the AI hasn't taken a drug or two.....

What I have always found difficult about that sort of thing, is: that the things that kick in in the future cannot be implemented now - because they either contradict the current regulations or, well, there is no way to apply an invalid regulation. For instance, I found once, here, that one can buy a new vehicle license disc before the expiry date of the current one, but, apparently, one cannot display the new one before the expiry date of the old one..... It does defy logic but .... so be it....

Anyway, the fascinating thing about your case is that someone got paid to sit down and construct and write all that stuff . . . . . good luck with the scenery down the rabbithole.

 

[hatzisn]

Yikes one assumes that those future dates are the actual implementation dates provided so that operators can get stuff in order and in line for that start date, versus, the date on which the whole document was published (2024). If indeed, the AI hasn't taken a drug or two.....

What I have always found difficult about that sort of thing, is: that the things that kick in in the future cannot be implemented now - because they either contradict the current regulations or, well, there is no way to apply an invalid regulation. For instance, I found once, here, that one can buy a new vehicle license disc before the expiry date of the current one, but, apparently, one cannot display the new one before the expiry date of the old one..... It does defy logic but .... so be it....

Anyway, the fascinating thing about your case is that someone got paid to sit down and construct and write all that stuff . . . . . good luck with the scenery down the rabbithole.

If you are looking for illogical laws then make a trip to Greece and... live "your myth" in Greece... as the as the Greek National Tourist Organization moto said in previous years. As far as it has to do with future dates, there is also the unwritten law that a project elongates in time as much as the available time for it so I suppose we will (might) be there in time.