The EU Cyber Resilience Act regulates software to increase security. Its approach is to regulate accountability. From December 2027, commercial products with digital elements must meet mandatory cybersecurity requirements: SBOMs, vulnerability disclosure, patch lifecycle commitments, and incident reporting. For the Nix ecosystem, the technical foundations are strong. The organizational foundations are not, bits and pieces are in place but a coherent whole is missing.

This talk surveys how comparable projects have organized for the CRA. FreeBSD has formally designated its Foundation as the project's Open Source Software Steward. Zephyr documented a seven-day vulnerability response commitment and restructured its release lifecycle around it. Yocto built per-CVE annotation tooling that turns triage into an auditable trail. Debian offers the deepest precedent: a dedicated Security Team, a separate LTS team, CVE Numbering Authority status, and a funding model that pays for sustained maintenance.