--- title: CRA readiness starts in the codebase | daily.dev description: The EU Cyber Resilience Act's practical demands land in engineering workflows rather than policy documents: pull requests, build pipelines, release approvals,... canonical: https://daily.dev/posts/cra-readiness-starts-in-the-codebase-241zchdhk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CRA readiness starts in the codebase | daily.dev og:description: The EU Cyber Resilience Act's practical demands land in engineering workflows rather than policy documents: pull requests, build pipelines, release approvals,... og:url: https://daily.dev/posts/cra-readiness-starts-in-the-codebase-241zchdhk og:image: https://api.daily.dev/og/posts/241zchDHK.png og:image:alt: CRA readiness starts in the codebase og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CRA readiness starts in the codebase **[The New Stack](https://daily.dev/sources/newstack)** · 8 min read · 1 upvotes · 0 comments ## Summary The EU Cyber Resilience Act's practical demands land in engineering workflows rather than policy documents: pull requests, build pipelines, release approvals, dependency records, and test suites. Organizations must be able to answer basic questions during an incident, such as which versions are affected and whether a fix actually works. A four-level maturity model (not evidenced, ad hoc, standard, enforced) helps assess controls, and seven questions cover secure defaults, scrutiny of security-sensitive changes, release traceability, pre-merge security checks, release-blocking enforcement, hostile-behavior testing, and runtime security validation. Reporting obligations for actively exploited vulnerabilities and severe incidents began September 11, with broader CRA obligations starting December 2027. Sonar's State of Code Developer Survey found 96% of developers don't fully trust AI-generated code, yet only 48% always verify it before committing, reinforcing the case for automated, enforced controls regardless of whether code comes from a human or an agent. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### When do Cyber Resilience Act reporting obligations for exploited vulnerabilities start applying? Manufacturers of products with digital elements in scope of the Cyber Resilience Act must report actively exploited vulnerabilities and severe incidents through the EU's reporting process starting September 11. Broader CRA obligations, covering the full range of compliance requirements, begin applying in December 2027. _Engineering teams tracking CRA deadlines can follow regulatory and security coverage on daily.dev._ ### What are the four maturity levels for assessing security controls under CRA readiness? Security controls can be assessed at four maturity levels: not evidenced, meaning the control is absent or unproven; ad hoc, meaning it happens inconsistently through individual effort; standard, meaning it is defined, consistently applied, and backed by evidence; and enforced, meaning it is automated, required, and can block unsafe work from progressing. _Teams building repeatable security controls into delivery pipelines can find related engineering practices on daily.dev._ ### What percentage of developers verify AI-generated code before committing it? Only 48% of developers said they always verify AI-generated code before committing it, according to Sonar's State of Code Developer Survey, even though 96% said they do not fully trust AI-generated code. This gap is cited as a reason for embedding automated checks that validate security controls regardless of whether code came from a human or an AI agent. _Developers weighing how much to trust AI-generated code can track verification practices on daily.dev._ ## Similar posts on daily.dev - [Cyber Resilience Act AI Automated Verification](https://daily.dev/posts/cyber-resilience-act-ai-automated-verification-j99324xbx) · Security Boulevard · 0 upvotes · 0 comments - [“The AI did it” won’t save you when EU regulators come knocking](https://daily.dev/posts/the-ai-did-it-won-t-save-you-when-eu-regulators-come-knocking-hzfxpwei4) · The New Stack · 0 upvotes · 0 comments - [Developing CRA-compliant products with us — Tweede golf](https://daily.dev/posts/developing-cra-compliant-products-with-us-tweede-golf-q5lbak6oy) · Tweede golf · 0 upvotes · 0 comments --- Tags: [#compliance](https://daily.dev/tags/compliance), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/cra-readiness-starts-in-the-codebase-241zchdhk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CRA readiness starts in the codebase","url":"https://daily.dev/posts/cra-readiness-starts-in-the-codebase-241zchdhk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cra-readiness-starts-in-the-codebase-241zchdhk"},"datePublished":"2026-09-30T13:04:25.831Z","dateModified":"2026-09-30T13:04:48.840Z","description":"The EU Cyber Resilience Act's practical demands land in engineering workflows rather than policy documents: pull requests, build pipelines, release approvals,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/48e0d2bf7a1377cdd7ad909aab523845?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/48e0d2bf7a1377cdd7ad909aab523845?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The New Stack","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The New Stack","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/newstack","url":"https://daily.dev/sources/newstack"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cra-readiness-starts-in-the-codebase-241zchdhk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"compliance,appsec","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The New Stack","item":"https://daily.dev/sources/newstack"},{"@type":"ListItem","position":3,"name":"CRA readiness starts in the codebase"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cra-readiness-starts-in-the-codebase-241zchdhk#faq","mainEntity":[{"@type":"Question","name":"When do Cyber Resilience Act reporting obligations for exploited vulnerabilities start applying?","acceptedAnswer":{"@type":"Answer","text":"Manufacturers of products with digital elements in scope of the Cyber Resilience Act must report actively exploited vulnerabilities and severe incidents through the EU's reporting process starting September 11. Broader CRA obligations, covering the full range of compliance requirements, begin applying in December 2027. Engineering teams tracking CRA deadlines can follow regulatory and security coverage on daily.dev."}},{"@type":"Question","name":"What are the four maturity levels for assessing security controls under CRA readiness?","acceptedAnswer":{"@type":"Answer","text":"Security controls can be assessed at four maturity levels: not evidenced, meaning the control is absent or unproven; ad hoc, meaning it happens inconsistently through individual effort; standard, meaning it is defined, consistently applied, and backed by evidence; and enforced, meaning it is automated, required, and can block unsafe work from progressing. Teams building repeatable security controls into delivery pipelines can find related engineering practices on daily.dev."}},{"@type":"Question","name":"What percentage of developers verify AI-generated code before committing it?","acceptedAnswer":{"@type":"Answer","text":"Only 48% of developers said they always verify AI-generated code before committing it, according to Sonar's State of Code Developer Survey, even though 96% said they do not fully trust AI-generated code. This gap is cited as a reason for embedding automated checks that validate security controls regardless of whether code came from a human or an AI agent. Developers weighing how much to trust AI-generated code can track verification practices on daily.dev."}}]} ```