The EU Cyber Resilience Act (Regulation 2024/2847) has two critical deadlines before its main December 2027 application date: notified-body rules start June 2026, and vulnerability/incident reporting under Article 14 kicks in September 2026. NuGet library authors — commercial or indirectly commercial — are likely in scope as 'products with digital elements.' Key obligations include a 24/72-hour vulnerability reporting cadence to national CSIRTs and ENISA, SBOM generation (CycloneDX recommended for .NET), secure-by-default API design, written end-of-life policies with a minimum 5-year support window, and CE marking via self-assessment for most general-purpose libraries. The open-source exemption is narrower than widely reported: accepting donations exceeding development costs counts as commercial activity. Practical steps include documenting vulnerability handling processes, integrating CycloneDX into release pipelines, signing packages, and publishing EoL dates.
