Cyber Resilience Act (CRA): What Software Teams Have to Do Now | JobRunr x Cresco

The EU Cyber Resilience Act is live. Since 11 September 2026, if you put software on the EU market and attackers are already exploiting a vulnerability in it, you have 24 hours from finding out to send an early warning to the authorities. Nicholas D'hondt (co-founder of JobRunr) sat down with Axel Desmet and Aida Kaloci, tech lawyers at Cresco, for a practical hour on what the CRA means for software teams. Who is in scope, which popular claims are wrong, what we did to make JobRunr CRA ready, and what you can do today. In this recording: • What the CRA is, and why it is product legislation, not service legislation • Who is in scope: internal software, SaaS, SDKs and open source you monetise • Six claims about the CRA, checked by the lawyers • How we made JobRunr CRA ready, as manufacturer for JobRunr Pro and open source steward for JobRunr OSS • What you can do now, plus the open question on security patches after a license ends • What an SBOM is, the log4j lesson, and generating one with CycloneDX in one Maven command • Q&A: does the CRA apply to open source written outside the EU? What to do now, in short: 1. Decide who handles a vulnerability report, who files the early warning and who is the backup. Rehearse it once. 2. Publish how people can report a vulnerability (SECURITY.md or security.txt) and route it to an inbox someone reads. 3. Create your account on ENISA's Single Reporting Platform before the day you need it. 4. Generate a machine-readable SBOM (CycloneDX or SPDX) for every release. 5. Fail the build on dependencies with known high-severity vulnerabilities. 6. Make sure you can ship security fixes for free and, where technically feasible, separately from feature releases. 7. Update your contract templates. Banks and insurers are already adding CRA clauses and security questionnaires. Chapters 00:00 Welcome and who we are 01:04 Agenda 02:08 What the Cyber Resilience Act is 06:48 Are you in scope? Self-assessment or third party 10:21 True or false: six CRA claims 10:39 Claim 1: software we only use internally is out of scope 11:55 Claim 2: open source is exempt 14:05 Claim 3: paid support makes you a manufacturer 14:59 Claim 4: nothing to do until December 2027 15:29 Claim 5: SaaS is out of scope 15:55 Claim 6: the 24-hour clock starts when the first email lands 18:03 How we made JobRunr CRA ready 22:38 What you can do now 27:34 Open question: five years of patches on a monthly license 28:19 What an SBOM is and why you need one 29:42 The log4j lesson 30:40 Generate an SBOM with CycloneDX (Maven and Spring Boot) 31:25 A CRA-ready build process 34:06 Q&A: does the CRA apply to non-EU open source? 36:49 Wrap-up and how to reach Cresco Speakers Nicholas D'hondt, Co-founder, JobRunr Axel Desmet, Associate, Cresco Aida Kaloci, Associate, Cresco Links JobRunr and the Cyber Resilience Act (scoping, disclosure policy, supported versions): https://www.jobrunr.io/en/cyber-resil... JobRunr SECURITY.md: https://github.com/jobrunr/jobrunr/bl... Cresco: https://www.crescolaw.com/ Recorded live on LinkedIn on 17 September 2026. This recording is general information, not legal advice. For your own situation, talk to a lawyer. #CyberResilienceAct #SBOM #Java