# CRA in practice @ FOSDEM 2026 Over the last few years we talked about the EU Cyber Resilience Act (CRA) quite a bit, highlighting its importance and raising awareness. Now we have less than one year until obligations for reporting security vulnerabilities and cyber incidents begin and less than two years until all the CRA requirements become mandatory. It's time to move from awareness ("oh no, regulations") to start actually getting ready ("okay, here's how we actually do this"). This devroom is practical CRA readiness for the FOSS community through open tooling, automation, documentation, and standards alignment that will make CRA compliance achievable and benefit everyone: developers, maintainers, stewards, and manufacturers. Community-driven solutions to regulatory challenges aim to reduce duplicative work, make compliance accessible for small projects without dedicated legal teams, keep the tools and data free, open, and transparent and enable the entire FOSS ecosystem to navigate CRA together. If your session helps developers, projects, or organizations move from awareness to actual readiness, with concrete, open-source solutions, we want to hear from you. We are looking for talks, panels, even workshops that help people take practical, developer-friendly actions. Think demonstrations, case studies, and real experiences, not policy deep-dives or legal strategy sessions. Specifically, we're interested in: - FOSS compliance tools in action: Showcasing what exists (OpenSSF Baseline and Scorecard, security-insights.yaml, SBOM/VEX tooling, etc.), what works, and where the gaps are - Open data and standards: Formats, models, and standards for compliance, security, and supply chain that everyone can use - Practical approaches: Reusable practices that make compliance achievable for projects of all sizes, from solo maintainers to large foundations - Real-world experiences: What FOSS maintainers actually need, what's working, what's painful - CRA readiness strategies: Mapping CRA requirements to concrete tools and workflows, due diligence practices, secure development automation - Ecosystem support: How stewards and foundations (like Linux Foundation, Eclipse, or Python Software Foundation) support their communities and what could be missing - Global framework alignment: Interoperability with US NIST/CISA, UK frameworks, ISO/IEC standards and other global cybersecurity initiatives - Manufacturer Due Diligence: How manufacturers can demonstrate due diligence when using OSS components To keep things focused and practical, we're explicitly leaving these topics to other devrooms and venues: - European policy analysis or legislative interpretation - Open source legal strategy or licensing questions - General CRA policy discussions without case study or technical implementation - Deep-dives into SBOMs (there is a separate room for it) Session Types and Lengths - please indicate your preferred format in your submission: - Lightning talks (10 minutes) – quick insights, new ideas, or fast demos - Standard talks (25 minutes) – deep dives or case studies - Panel (40 min) – cross-role discussions on a key CRA challenge - Workshop (40 min) - hands-on demonstration Important Dates: - CfP opens: 7th November 2025 - CfP closes: 1st December 2025 (23:59 UTC) - Notification of acceptance: mid-December 2025 - Devroom at FOSDEM 2026: Saturday, 31st January 2026, Brussels NOTE: You must be available in person to present your talk. ## How to Submit To submit a talk follow https://pretalx.fosdem.org/fosdem-2026/cfp, select **CRA in practice** as the *Track* and ensure you include all the requested information when submitting a proposal. Code of Conduct: We'd like to remind all speakers and attendees that all of the presentations and discussions in our devroom are held under the guidelines set forth in the [FOSDEM Code of Conduct](https://fosdem.org/2026/practical/conduct/) and we expect everyone attending to follow it. Would like to volunteer and help onsite or have any questions? Reach out to organizers. Organizers’ contacts: - Roman Zhukov - rzhukov[at]redhat[.]com - Madalin Neag - mneag[at]contractor[.]linuxfoundation[.]org - Megan Knight - megan[.]knight[at]arm[.]com - Philippe Ombredanne - pombredanne[at]aboutcode[.]org