E2 - Supply Chain and the CRA

Piet and August dig into supply chain security as a hidden third goal of the EU Cyber Resilience Act. They break down the CRA's upstream and downstream obligations for manufacturers, tackle the tricky question of how to handle open source and first-party components, and explore the difference between proactive due diligence and reactive vulnerability monitoring. The episode closes with a thought-provoking finding: the CRA may allow authorities to deem a product non-compliant based on where it was made and who made it, raising questions about digital sovereignty that go far beyond technical security.

Ode to Resilience is hosted by

Piet De Vaere: Electrical Engineer, CRA consultant & Member of the CRA Expert Group (Linkedin | Webpage)

and

August Bournique: Silicon Valley technology lawyer, CRA consultant & Special Rapporteur for ETSI CRA standards (Linkedin | Webpage)

You can reach out to us on: [email protected]