Over 80% of modern software is built on open source components, yet the EU's Cyber Resilience Act means that "free to use" no longer means "free from responsibility." This keynote unpacks what the CRA means for device manufacturers who rely on open source software, and why your software supply chain is now a compliance liability. We'll walk through the four product categories under the CRA, the mandatory requirements from SBOM to vulnerability disclosure, and how manufacturers can choose between building their own compliance infrastructure or consuming it from a trusted vendor. Attendees will leave with a clear picture of the steps needed to achieve CRA compliance by 2027, and how open source, done right, can be a compliance asset rather than a risk.