EU Cyber Resilience Act: What Drupal Suppliers Must Assess

Software manufacturers supplying products covered by the European Union's Cyber Resilience Act (CRA) have been subject to mandatory security reporting requirements since 11 September 2026. The European Commission's implementation guidance distinguishes these responsibilities from the work of open-source projects whose components may be incorporated into commercial products. For organisations distributing Drupal-based software, the distinction affects how they assess vulnerabilities, document dependencies and determine their legal responsibilities.

Public investment has supported security improvements across Drupal's shared infrastructure, while initiatives such as OpenChain have developed tools to help organisations prepare for the CRA. These activities can support manufacturers, but they do not replace the assessments and obligations that apply to products placed on the EU market. The requirements also differ according to whether an organisation supplies a covered product, contributes to open-source software or provides sustained support as an open-source software steward.

The European Commission's implementation FAQ, first published on 3 December 2025 and updated on 4 September 2026, explains the scope and application of the regulation. It covers software products supplied for use or integration into other systems, including separately distributed components. The Commission identifies the FAQ as non-binding guidance that does not replace the regulation itself.

An agency distributing a downloadable Drupal-based application under its own name may qualify as its manufacturer if the application is a covered product. The Commission distinguishes these products from ordinary websites that do not support the functionality of a covered digital product. Standalone software-as-a-service offerings are also generally outside the CRA's product scope unless they qualify as a product's remote data-processing solution. Payment for Drupal website development does not, by itself, establish that the resulting website is a covered product.

The CRA's manufacturer reporting obligations began on 11 September 2026, ahead of the principal product requirements taking effect on 11 December 2027. Manufacturers must report actively exploited vulnerabilities and severe incidents affecting the security of covered products. These reporting duties can also apply to products placed on the market before December 2027, even where those products are not yet subject to the regulation's full conformity requirements.

The Commission's guidance on open-source software distinguishes software made available through commercial activity from non-commercial contributions. It also describes the separate category of open-source software stewards: legal entities providing sustained support for the development and viability of qualifying open-source products intended for commercial activities. Stewards have obligations under Article 24, including cybersecurity policies and cooperation with market surveillance authorities. Their reporting obligations under Article 24(3) begin on 11 December 2027. Although they are exempt from CRA administrative fines, the exemption does not remove their obligations.

Manufacturers of covered products must prepare technical documentation and assess cybersecurity risks. Annex I of Regulation (EU) 2024/2847 requires a machine-readable software bill of materials (SBOM) documenting at least top-level dependencies. Annex VII specifies technical documentation covering matters including the product's intended purpose, software versions, design and vulnerability-handling processes. Manufacturers must also document the measures used to meet applicable essential cybersecurity requirements.

Drupal applications may incorporate contributed modules, Composer-managed libraries and components installed through other methods. Their manufacturers must therefore examine the dependencies present in the products they distribute rather than assume that a single package-management record necessarily represents every component. The statutory minimum for SBOM coverage should also be distinguished from more extensive dependency analysis recommended as good practice.

OpenChain's CRA Compliance Requirements and Checklist provides a framework for organising compliance evidence. Version 1.0 was released on 11 September 2026, according to the project's September newsletter. The checklist separates regulatory requirements from implementation controls and recommended practices. Completing the checklist does not itself establish legal conformity or replace any applicable conformity assessment procedure.

A component's inclusion in an SBOM does not automatically make every vulnerability affecting that component reportable. The Commission's FAQ explains that a vulnerability actively exploited in an integrated component does not trigger mandatory manufacturer notification if the vulnerability cannot be exploited in the containing product. That determination requires an assessment of the supplied product and its operational conditions. Even where mandatory notification to authorities is not required, the manufacturer may still have obligations to inform the component's manufacturer or maintainer under Article 13(6).

You May Like

Blog

The Storytelling We Are Passionate About

Blog

The Storytelling We Are Passionate About

The Linux Foundation's 5 August 2026 programme announcement for Open Source Summit and Embedded Linux Conference Europe, held in Prague from 7 to 9 October, identified SBOMs for CRA readiness among its safety-critical software topics. The published programme also featured a session titled "ORBIT Launchpad: Building the Due Diligence Bridge Between Manufacturers and Open Source," presented by Nicole Bates-Callaghan of Microsoft and Sarah Evans of Dell Technologies. The announcement establishes the programme's emphasis on manufacturer and upstream relationships but does not report outcomes from the session.

Drupal's publicly supported security work predates these compliance deadlines. The Drupal Association announced a $300,000 service contract from Germany's Sovereign Tech Fund on 11 January 2024. Its announcement identified two areas of work: developer tools acceleration and community supply-chain security. Plans included GitLab improvements, secure package signing and third-party security audits of the PHP-TUF client, Rugged server and Drupal integration code. The association expected the contracted projects to conclude before 31 March 2024.

Further support followed in 2025. The Drupal Association announced €201,000 in funding on 29 October 2025 to improve Drupal's GitLab infrastructure. The planned work included migrating security issue management to GitLab, optimising continuous integration testing and improving tools for user-experience and design contributors. These were separate investments in Drupal's shared development and security infrastructure, rather than funding awards to individual Drupal product manufacturers for CRA conformity.

The Sovereign Tech Agency has also expanded its security support through the Sovereign Tech Resilience programme. Its 23 February 2026 explanation of a new procurement process identified CRA compliance as an additional area of work, alongside supply-chain security, memory safety and post-quantum encryption readiness. The agency's programme description includes services such as gap assessments, security documentation, vulnerability-handling processes, maintainer training and conformity assessment support where applicable.

Participation in those services is subject to project eligibility and programme arrangements. The programme description does not identify Drupal as a recipient of CRA-specific assistance. The previously announced Drupal funding and the broader Resilience programme should therefore not be treated as evidence of an additional Drupal compliance award.

These developments establish separate responsibilities within the software supply chain. Public funding can improve upstream security processes, and shared guidance can help organisations organise compliance work. Manufacturers distributing covered Drupal-based products must still establish which requirements apply, assess vulnerabilities in their products and maintain the documentation required under the CRA.