Free as in Freedom: How OEMs Can Navigate EU Cybersecurity Rules Whilst Using Open Source

The EU Cybersecurity Resilience Act is keeping OEMs awake at night. How do you use free and open-source software whilst complying with new obligations around vulnerability management, supply chain transparency, and continuous support?

In this episode, Pierre Gal (Head of Product) from Witekio and Michael Röder (Senior Manager, Software and Services EMEA) from Avnet Silica tackle the urgent questions facing manufacturers: Who counts as a manufacturer under the CRA? What documentation must you maintain? And how do you manage vulnerabilities in components you didn't create?

Pierre explains how Witekio's Embedded Kit provides off-the-shelf solutions based on open-source software like Yocto Linux, helping customers navigate composition, integration, and compliance. Michael shares what he's hearing from customers struggling to interpret regulatory requirements and implement risk-based approaches.

From SBOM (Software Bill of Materials) to supply chain attacks, from secure by default to continuous vulnerability management, we explore the practical realities of making compliance work. The conversation cuts through the confusion to deliver actionable advice: understand your responsibilities, think in terms of composition, and don't wait for a magic bullet.

Tune in to learn how to leverage the power of open-source software whilst meeting your CRA obligations – because "free as in freedom" doesn't mean free from responsibility.

#CRA #cybersecurity #opensource #FOSS #compliance #IoT #wetalkiot

Summary of this week's episode:

Key Dates and Obligations of the CRA

Challenges Faced by Manufacturers

The Role of Open Source in CRA Compliance

The Concept of Software Bill of Materials (SBOM)

Real-World Example: Casino Attack Case Study

Documentation and Configuration Issues

Cybersecurity Layers and CRA Methodology

Secure by Default and Advanced Concepts

Implementation and Standard Processes

Quality, Testing, and Automation