Shortly after the Second Raku Core Summit in June, it became clear that there was an elephant in the room that had not been discussed enough: the progressive implementation of the Cyber Resilience Act in Europe and how this will affect open source software and in particular the Raku programming language.
In essence, the key obligation is as follows: companies must carry out cyber risk assessments before placing a product on the market and maintain a data inventory and documentation for the 10 years after its market launch or during its support period, whichever is longer. This requirement directly clashes with the reality of many custom software and open source software projects, where complete dependency traceability is not always automated.
The critical point for programming languages in general and for Raku in particular is the concept of cyber risk assessments on a program and all its dependencies. Today, this task is largely done manually, making it too costly and complex for many companies that consume open source. That cost could lead organizations to reduce their use of open projects or to demand additional guarantees from vendors and developers.
Fortunately, the concept of Software Bill of Materials, or SBOM, has existed for a decade and helps resolve that traceability. An SBOM is a machine-readable representation of all the dependencies of an application installed in a given environment, and it enables automated assessments against known vulnerabilities.
Several SBOM standards are in use. The two most relevant are SPDX and CycloneDX, based on ECMA 424. CycloneDX has proven particularly suitable for open source projects and workflows that require interoperability and details about runtime components, making it a natural choice for the Raku community.
A practical example: if a vulnerability is discovered in the OpenSSL library and a European company uses a Cro application as the backend for its mobile app, Cro may depend on IO::Socket::Async::SSL, which in turn depends on the OpenSSL distribution and therefore on the system's OpenSSL library. The company must be able to identify that dependency chain, assess the risk, apply the necessary updates within the deadlines set by regulations, and issue an updated SBOM proving compliance with the Cyber Resilience Act.
Are we ready for this right now? Not entirely. EU discussions on what must be produced and within what timelines are still ongoing, but it seems that conclusions will come in months rather than years. That is why it is time to prepare the Raku ecosystem for this new regulatory environment.
Far from being just a threat, the Cyber Resilience Act represents an opportunity for open source projects and for languages like Raku. Requiring clear SBOMs and risk assessments will foster better quality, security, and maintenance practices, and will allow developers and companies to demonstrate accountability and compliance to clients and regulators.
At Q2BSTUDIO, we see this transition as an opportunity to help companies and communities adapt. We are a custom software and application development company specializing in artificial intelligence, cybersecurity, and much more. We offer custom software services, custom applications, AWS and Azure cloud services, business intelligence services, and Power BI solutions. We also develop AI agents and AI solutions for companies that automate risk assessments, generate SBOMs in CycloneDX or SPDX formats, and facilitate dependency governance in production environments.
Our services cover everything from cybersecurity audits and automated SBOM generation to continuous integration that updates component inventories in real time and remediation pipelines to quickly mitigate vulnerabilities. With artificial intelligence solutions applied to security and business intelligence, we help prioritize risks, predict impact, and reduce response times to incidents.
In the specific case of Raku, we have begun developing tools that automate dependency collection, the creation of SBOMs compatible with CycloneDX and SPDX, and the linking with vulnerability databases to enable programmatic assessments. These initiatives seek to turn the potential regulatory risk into a competitive advantage for projects and companies that use Raku.
Conclusion: exciting times are ahead. The Cyber Resilience Act accelerates the demand for traceability, security, and accountability throughout the software lifecycle. For the Raku community and for open source software in general, this can be a push toward more robust and sustainable practices. At Q2BSTUDIO, we are ready to accompany organizations on that journey, bringing expertise in custom software development, artificial intelligence, cybersecurity, AWS and Azure cloud services, business intelligence services, AI agents, and Power BI to improve both regulatory compliance and operational efficiency.
In upcoming blog posts, we will detail specific aspects of the CRA and show the software we have developed to turn the threat into an opportunity for Raku and for any organization that needs to meet the new cyber resilience requirements.
