As the Cyber Resilience Act (CRA) moves from awareness to implementation, a deeper challenge is becoming clear: compliance is not just a regulatory exercise, but a question of software sovereignty.
Many organizations still approach CRA as a tooling or certification problem. In practice, the main barriers are structural. Companies lack full visibility into their software supply chains, underestimate the complexity of their dependencies, and rely on standards that do not fully address regulatory accountability.
This talk shares practical insights from working with industry stakeholders navigating CRA readiness today. It highlights persistent challenges such as delayed prioritization, limited supplier awareness, and unclear ownership of responsibilities across organizations.
More importantly, it reframes CRA compliance as an issue of control. Who is responsible for vulnerabilities? Who owns the risk across the supply chain? And how can organizations maintain oversight in ecosystems built on open technologies?
The session also explores how collaborative initiatives such as the Eclipse Foundation’s Open Regulatory Compliance Working Group are helping companies move toward shared approaches, reducing fragmentation while strengthening collective control over compliance processes.
Attendees will gain a clearer understanding of how sovereignty, not just compliance, is becoming a defining factor in the future of software development.
