What is the CRA and why do we care?

Lara and I kick off our new series on the EU Cyber Resilience Act (CRA), where we'll go deep on what the regulation actually means for product security teams and how to translate it into concrete application security practice. Chapters: 00:00 Introduction 01:32 Why should we care? 03:38 Safety vs security 05:02 Is CRA just another GDPR? 07:02 What is security? 10:26 What is a product with digital elements (PDE)? 13:46 Type of PDEs in the context of the CRA 16:16 The CRA horizontal and vertical standards 18:55 CRA enforcement timelines 22:42 Recap In this first episode, we cover the foundations: What the CRA is and why it exists Which products fall under its scope, and which don't How compliance requirements differ between product categories (default, important, and critical) The role of horizontal and vertical standards, and how they fit together What's at stake if you simply ignore the regulation — the penalties, market access consequences, and liability implications To help you figure out where your product stands, we've also built a CRA screening tool that walks you through the key scoping questions and gives you a first read on your obligations. In the coming episodes, we'll move from the regulatory frame into the practical side: what "secure by design," vulnerability handling, SBOMs, and conformity assessments actually look like when you're shipping real products. Links: 👉 Try the CRA screening tool: https://sammy.codific.com/cra 👉 Subscribe so you don't miss the next episodes.