What the EU Cyber Resilience Act means for your Linux devices (2026-2027)

The dates

• 10 December 2024: the CRA entered into force.
• 11 September 2026: reporting started. Manufacturers must report actively exploited vulnerabilities and severe incidents affecting their products: an early warning within 24 hours, a notification within 72 hours, then a final report. This applies to products already on the market too.
• 11 December 2027: everything else applies, including the security requirements, vulnerability handling and the CE marking.

What it asks of makers of Linux devices

• Secure by design and by default, with no known exploitable vulnerabilities when the product is placed on the market.
• A support period you state up front, normally at least five years (shorter only if the product is expected to be used for less), during which you fix vulnerabilities.
• Security updates, free of charge, delivered without delay during the support period and, where possible, separately from feature updates.
• A software bill of materials (SBOM) of the product's components, at least the top-level dependencies, so you know which devices a new vulnerability affects.
• Vulnerability handling: a way for others to report problems to you, and a process to fix and disclose them.

Why remote updates are the practical answer

Promising five years of security updates is only realistic if you can deliver them to devices that sit in shops, factories and customers' buildings, behind firewalls, often offline. Doing that by hand does not scale; over-the-air updates do. And when you must report an exploited vulnerability within 24 hours, you also need to know quickly which devices are affected and to see that the fix reached each of them.

What KinuxOTA covers today, and what comes next

• Today: update packages on many Ubuntu, Debian and Raspberry Pi OS devices at once, with each device's result kept in the run history; deliver your own files and .deb packages with checksums verified on the device; devices that were offline catch up; see each device's installed packages and versions.
• Planned: signed update artifacts, phased rollouts to groups, full-system A/B updates with rollback, an SBOM per release, CVE monitoring of your devices' software, and reports you can hand to authorities and customers.

KinuxOTA follows the CRA for its own agent too: it is distributed from a signed apt repository and we publish a vulnerability disclosure policy. More about the kinds of update: What is OTA?