--- title: The EU Cyber Resilience Act is coming, and Determinate... description: The EU Cyber Resilience Act (CRA) begins its first compliance stage on September 11, 2026, requiring 24-hour reporting of exploited vulnerabilities, with full... canonical: https://daily.dev/posts/the-eu-cyber-resilience-act-is-coming-and-determinate-is-the-missing-link-in-your-supply-chain-r8unnvjh8 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The EU Cyber Resilience Act is coming, and Determinate is the missing link in your supply chain | daily.dev og:description: The EU Cyber Resilience Act (CRA) begins its first compliance stage on September 11, 2026, requiring 24-hour reporting of exploited vulnerabilities, with full... og:url: https://daily.dev/posts/the-eu-cyber-resilience-act-is-coming-and-determinate-is-the-missing-link-in-your-supply-chain-r8unnvjh8 og:image: https://api.daily.dev/og/posts/R8uNnvJh8.png og:image:alt: The EU Cyber Resilience Act is coming, and Determinate is the missing link in your supply chain og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The EU Cyber Resilience Act is coming, and Determinate is the missing link in your supply chain **[Determinate Systems](https://daily.dev/sources/determinate-systems)** · 13 min read · 0 upvotes · 0 comments ## Summary The EU Cyber Resilience Act (CRA) begins its first compliance stage on September 11, 2026, requiring 24-hour reporting of exploited vulnerabilities, with full requirements including CE marking applying from December 11, 2027. The regulation demands SBOMs covering at least top-level dependencies, shipping without known exploitable vulnerabilities, five-year remediation obligations, and due diligence on third-party and open-source components, with penalties up to €15 million or 2.5% of global turnover. Nix's closures, derivations, and sandboxing are presented as natively aligned with these requirements, and Determinate Systems positions its Secure Packages, FlakeBOM, and FlakeAudit tools as the concrete deliverables (CycloneDX SBOMs, VEX triage metadata, CI policy gates, and SBOM diffing) needed to satisfy CRA obligations. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### When do the EU Cyber Resilience Act reporting obligations take effect? The first stage of the EU Cyber Resilience Act takes effect on September 11, 2026, requiring manufacturers to report actively exploited vulnerabilities and severe incidents to European authorities within 24 hours. The rest of the regulation, including essential requirements, conformity assessment, and CE marking, applies starting December 11, 2027, per Regulation (EU) 2024/2847 which entered into force December 10, 2024. _daily.dev helps teams tracking regulatory deadlines like the CRA stay ahead of compliance requirements._ ### What are the penalties for violating the EU Cyber Resilience Act's essential requirements? Article 64 of the Cyber Resilience Act sets penalties for breaching essential requirements at up to €15 million or 2.5% of total worldwide annual turnover, whichever amount is higher. This applies to manufacturers of products with digital elements sold into the EU, whether or not the company is headquartered there. _engineers preparing compliance strategies can follow regulatory and supply-chain security coverage on daily.dev._ ### How does Nix help generate a software bill of materials for CRA compliance? Nix closures provide a complete transitive set of everything needed to build or run software, so an SBOM can be derived directly rather than reconstructed through scanning or inference. Tools like FlakeBOM generate CycloneDX 1.5 JSON SBOMs from a Nix flake, walking the full dependency closure, detecting vendored dependencies in fetchers like fetchNpmDeps, and attaching Package URL identifiers, producing a roughly 60MiB SBOM for over 10,000 components in under two minutes. _developers building supply chain tooling around SBOMs can track Nix ecosystem updates on daily.dev._ ## Similar posts on daily.dev - [EU Cyber Resilience Act \(CRA\): Overview](https://daily.dev/posts/eu-cyber-resilience-act-cra-overview-2thbpzeiw) · Docker · 0 upvotes · 0 comments - [EU’s Cyber Resiliency Act will put IT leaders to the test](https://daily.dev/posts/eu-s-cyber-resiliency-act-will-put-it-leaders-to-the-test-ufqkjfyfz) · CSO Online · 0 upvotes · 0 comments - [Cyber Resilience Act Compliance \(CRA\) with Aikido Security](https://daily.dev/posts/cyber-resilience-act-compliance-cra-with-aikido-security-0yzywsub3) · Aikido Security · 0 upvotes · 0 comments - [The Cyber Resilience Act and Cloud Native: Understanding the Impact](https://daily.dev/posts/the-cyber-resilience-act-and-cloud-native-understanding-the-impact-twcmbbmqq) · Cloud Native Now · 1 upvotes · 0 comments - [ENISA Publishes Technical Advisory on Secure Use of Package ...](https://daily.dev/posts/enisa-publishes-technical-advisory-on-secure-use-of-package--gyu409m0z) · Socket · 0 upvotes · 0 comments --- Tags: [#compliance](https://daily.dev/tags/compliance), [#sbom](https://daily.dev/tags/sbom) [View this post on daily.dev](https://daily.dev/posts/the-eu-cyber-resilience-act-is-coming-and-determinate-is-the-missing-link-in-your-supply-chain-r8unnvjh8) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The EU Cyber Resilience Act is coming, and Determinate is the missing link in your supply chain","url":"https://daily.dev/posts/the-eu-cyber-resilience-act-is-coming-and-determinate-is-the-missing-link-in-your-supply-chain-r8unnvjh8","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-eu-cyber-resilience-act-is-coming-and-determinate-is-the-missing-link-in-your-supply-chain-r8unnvjh8"},"datePublished":"2026-08-13T16:26:56.434Z","dateModified":"2026-08-13T16:27:24.415Z","description":"The EU Cyber Resilience Act (CRA) begins its first compliance stage on September 11, 2026, requiring 24-hour reporting of exploited vulnerabilities, with full...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/de1807d6d22611bf1173b6d36209236d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/de1807d6d22611bf1173b6d36209236d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Determinate Systems","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Determinate Systems","logo":"https://media.daily.dev/image/upload/s--E2qrkc9w--/c_limit,w_256/f_auto,q_auto/v1785052094/logos/determinate-systems?_a=BAMAMicg0","url":"https://daily.dev/sources/determinate-systems"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-eu-cyber-resilience-act-is-coming-and-determinate-is-the-missing-link-in-your-supply-chain-r8unnvjh8","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"compliance,sbom","timeRequired":"PT13M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Determinate Systems","item":"https://daily.dev/sources/determinate-systems"},{"@type":"ListItem","position":3,"name":"The EU Cyber Resilience Act is coming, and Determinate is the missing link in your supply chain"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-eu-cyber-resilience-act-is-coming-and-determinate-is-the-missing-link-in-your-supply-chain-r8unnvjh8#faq","mainEntity":[{"@type":"Question","name":"When do the EU Cyber Resilience Act reporting obligations take effect?","acceptedAnswer":{"@type":"Answer","text":"The first stage of the EU Cyber Resilience Act takes effect on September 11, 2026, requiring manufacturers to report actively exploited vulnerabilities and severe incidents to European authorities within 24 hours. The rest of the regulation, including essential requirements, conformity assessment, and CE marking, applies starting December 11, 2027, per Regulation (EU) 2024/2847 which entered into force December 10, 2024. daily.dev helps teams tracking regulatory deadlines like the CRA stay ahead of compliance requirements."}},{"@type":"Question","name":"What are the penalties for violating the EU Cyber Resilience Act's essential requirements?","acceptedAnswer":{"@type":"Answer","text":"Article 64 of the Cyber Resilience Act sets penalties for breaching essential requirements at up to €15 million or 2.5% of total worldwide annual turnover, whichever amount is higher. This applies to manufacturers of products with digital elements sold into the EU, whether or not the company is headquartered there. engineers preparing compliance strategies can follow regulatory and supply-chain security coverage on daily.dev."}},{"@type":"Question","name":"How does Nix help generate a software bill of materials for CRA compliance?","acceptedAnswer":{"@type":"Answer","text":"Nix closures provide a complete transitive set of everything needed to build or run software, so an SBOM can be derived directly rather than reconstructed through scanning or inference. Tools like FlakeBOM generate CycloneDX 1.5 JSON SBOMs from a Nix flake, walking the full dependency closure, detecting vendored dependencies in fetchers like fetchNpmDeps, and attaching Package URL identifiers, producing a roughly 60MiB SBOM for over 10,000 components in under two minutes. developers building supply chain tooling around SBOMs can track Nix ecosystem updates on daily.dev."}}]} ```