The vendors furthest ahead on the CRA didn't do it for the CRA

Over the past weeks I've talked to a number of small European software companies about the Cyber Resilience Act. A pattern showed up that I didn't expect, and it changed how I think about the whole thing.

The companies furthest ahead on CRA readiness mostly didn't get there because of the CRA.

What they had in common

One vendor I spoke to had already folded the whole topic into their information security management system, as part of an ISO 27001 certification. When I mentioned the CRA, the answer was essentially: "we're covered, this was handled a while ago." Not because a regulation told them to. Because their certification, and the customers who demanded that certification, told them to.

That's the tell. The readiness was real, but the motivation was commercial. A big customer's security team asked hard questions, and the vendor answered them to keep the account.

Why this matters

Most CRA content, including a fair bit of mine early on, leans on the regulation as the reason to act. Deadlines, penalties, obligations. And for the smallest vendors, a lot of that turns out to be softer than the headlines suggest.

But the commercial driver doesn't soften. It gets stronger. Every year, more enterprise and public-sector buyers put supply-chain security questions into their procurement process. They want to know what's in the software they depend on, and whether it's vulnerable. They ask regardless of what any regulation says, because their own risk depends on your answer.

So the durable reason to know what's in your product was never really the law. It's that your customers are going to ask, the good ones already are, and the vendors who can answer keep winning the work. The regulation just put a date on a question the market was already learning to ask.