Piet and August dig into supply chain security as a hidden third goal of the EU Cyber Resilience Act. They break down the CRA's upstream and downstream obligations for manufacturers, tackle the tricky question of how to handle open source and first-party components, and explore the difference between proactive due diligence and reactive vulnerability monitoring. The episode closes with a thought-provoking finding: the CRA may allow authorities to deem a product non-compliant based on where it was made and who made it, raising questions about digital sovereignty that go far beyond technical security.

Ode to Resilience is hosted by

Piet De Vaere: Electrical Engineer, CRA consultant & Member of the CRA Expert Group (Linkedin | Webpage)

and

August Bournique: Silicon Valley technology lawyer, CRA consultant & Special Rapporteur for ETSI CRA standards (Linkedin | Webpage)

You can reach out to us on: [email protected]

In the debut episode of Ode to Resilience, Piet and August introduce themselves and lay the groundwork for the podcast by answering the most basic question: what is the EU Cyber Resilience Act? They break down what "products with digital elements" actually covers (spoiler: nearly everything digital), walk through the four main pillars of CRA requirements, from product security and secure development processes to long-term support obligations and vulnerability reporting, and demystify the compliance timeline. The episode closes with a grounded take on enforcement and the famously large fines, reassuring listeners that the CRA, while ambitious, is fundamentally reasonable and manageable for manufacturers willing to take cybersecurity seriously.

Ode to Resilience is hosted by

Piet De Vaere: Electrical Engineer, CRA consultant & Member of the CRA Expert Group (Linkedin | Webpage)

and

August Bournique: Silicon Valley technology lawyer, CRA consultant & Special Rapporteur for ETSI CRA standards (Linkedin | Webpage)

You can reach out to us on: [email protected]