Community guidelines
Last updated
This board exists so that people responsible for Cyber Resilience Act compliance can get a straight answer from fellow CRA practitioners and experts. These guidelines are what keep it that way.
This is a starting draft. It has not been reviewed by a lawyer, and the bracketed values still need filling in before launch.
1. What this board is for
Practical questions about implementing Regulation (EU) 2024/2847 — scope, obligations, conformity assessment, reporting, timelines and the day-to-day of getting a product compliant. Concrete beats abstract: the useful thread is the one that says what the product is, what the doubt is, and what has already been tried.
CRA Updates is an independent community resource brought to you by the team behind FOSSA, a software security and compliance platform. It is not affiliated with, endorsed by, or acting on behalf of the European Commission or any EU institution.
2. Asking a good question
- Say what you are. Manufacturer, importer, distributor or open-source steward — the answer usually turns on it.
- Give the facts, not the conclusion. Product type, how it connects, who ships it, which deadline you are working towards.
- Search before posting. If a thread already covers it, reply there instead of starting a parallel one.
- File it under a topic. Topics are how people find your question months later.
- Leave out anything confidential. Redact customer names, internal documents and unpatched vulnerability detail. This board is public and indexed.
3. Answering well
- Cite the source. Point at the article, annex or standard, and link the Official text on EUR-Lex where it helps.
- Separate what the text says from what you think it means. Both are welcome; conflating them is not.
- Say how confident you are, and say when you do not know. “I read it this way, but it is untested” is a better answer than false certainty.
- Disclose an interest. If you sell a product or service that solves the problem you are answering, you may mention it where it is relevant — but say so in the post, and give an answer that stands without it.
4. Bylines, organisations and expert badges
Every post carries the display name on your account, and the organisation if you gave one. That byline exists so readers can weigh advice. A handle is fine — you do not need to use your real name — but do not post under someone else’s name, and do not claim an employer, role or qualification you do not hold.
Some contributors carry a badge marking them as a verified expert or as staff. Badges are granted by us on the basis of demonstrable experience, they are not for sale, and they can be withdrawn. A badge signals track record — it does not give an answer any regulatory standing, and it does not make it legal advice.
Your byline is published deliberately, and it stays under your control: ask us and we will change your display name or drop your organisation. What we do with that data, and how it is handled when you close your account, is set out in the privacy policy.
5. Not allowed
- Personal attacks, harassment, or hostility towards a person rather than an idea.
- Marketing, lead generation, and answers whose real purpose is to promote a product. Mentioning your own product is fine when it answers the question and you disclose the interest (see section 3); a post that exists to sell it is not.
- Posting other people’s personal data, confidential material, or exploit code for an unpatched product.
- Impersonation, invented credentials, and vote or reputation manipulation through multiple accounts.
- Suggesting that a post, a badge or this site carries any endorsement from the European Commission or any EU institution.
- Anything unlawful, or anything that breaks the terms of service.
6. How moderation works
Moderators read reports and act on them. Depending on what happened, that means moving a post to the right topic, closing a thread, hiding or deleting a post or reply, or suspending an account. We aim to explain the reason where it is practical and lawful to do so.
We do not review everything before it appears, and a post staying up is not an endorsement of it. If something breaks these guidelines, email a moderator at moderator@craupdates.com with a link rather than replying to it in the thread — reports are handled privately.
Threads are moved or closed rather than removed wherever possible: the archive is the point of the board, and a removed thread takes an answer away from whoever needs it next.
7. Appeals and contact
If you think a moderation decision was wrong, write to moderator@craupdates.com with a link to the post. A moderator who was not involved in the original decision will look at it again.
Ready to post? Browse the discussions.