The Cyber Resilience Act introduces new expectations regarding software development, security and accountability. For consulting companies, implementation presents particular challenges. We develop software that we do not own, maintain systems that we did not design, and operate within customer processes, budgets and priorities that we cannot control.

Responsibilities are distributed, contractual boundaries are not always clear, and engineering teams must reconcile regulatory expectations with delivery commitments. The costs extend beyond tooling and formal processes, consuming engineering capacity that is rarely accounted for.

This session reflects on our experience of introducing CRA-related practices in a consulting environment. We will examine what has worked, where difficulties persist and which assumptions have been hard to reconcile with day-to-day engineering.

A central question is how to engage people. While compliance can be mandated, meaningful adoption requires more than just instructions, checklists and additional controls. Changing established practices, gaining acceptance and balancing competing interests remain substantial challenges.

We will discuss the lessons we have learned, the unresolved questions we have, and the possible directions in which we could move as CRA implementation moves from regulatory interpretation into engineering reality.

The Cyber Resilience Act is complex to navigate in consulting environments due to distributed responsibilities and external constraints. This session will share practical insights on overcoming these challenges, focusing on meaningful adoption beyond compliance checklists and on balancing regulatory demands with engineering realities.

The key takeaways are:
- Implementing the CRA in a consulting environment is challenging because software ownership and control are often external.
Clear contractual boundaries are essential, yet they are often lacking, which complicates the allocation of responsibility.
Compliance efforts consume significant engineering resources, extending beyond tooling and processes.
Successful CRA adoption requires cultural change and active engagement, not just mandates.
Balancing regulatory requirements with delivery commitments remains a persistent challenge.