Buying and running it · Lesson 10 of 10
CRA and NIST SSDF: what AppSec teams need to know
ANSWER FIRST
Two public frameworks shape secure development requirements for AppSec teams. The EU Cyber Resilience Act's reporting obligations apply from 11 September 2026, and NIST's Secure Software Development Framework (SP 800-218) sets out the practices many buyers ask suppliers to follow.
Editorial assessment · Compiled from vendor product, docs, pricing and marketplace pages · Rated October 2026
By Best AI Code Security reviewers · 16 September 2026 · 2 min read
What does the CRA require from 11 September 2026?
Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents that affect product security. The timeline is an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report no later than 14 days after a corrective measure is available (for actively exploited vulnerabilities) or within one month of the 72-hour notification (for severe incidents).
Manufacturers report once, through the CRA Single Reporting Platform, to the CSIRT where they have their main establishment; the report is shared with other CSIRTs where the product is available and made available to ENISA. Open-source software stewards face the same reporting obligations from 11 December 2027.
Source: European Commission: CRA reporting obligations · Reviewed Sep 2026
What is the SSDF?
NIST SP 800-218, the Secure Software Development Framework, is a set of fundamental secure software development practices organized in four groups: Prepare the Organization, Protect the Software, Produce Well-Secured Software, and Respond to Vulnerabilities. NIST SP 800-218A is a community profile of those practices for generative AI and dual-use foundation models.
Source: NIST CSRC: SSDF · Reviewed Sep 2026
What does this mean for AI-generated code?
The CRA's reporting duty attaches to the product, whoever or whatever wrote its code. A 24-hour clock rewards knowing quickly which products contain an affected component, which is what an SBOM or an AI-BOM records. An inventory, scanning at pull request and a record of what agents changed are the parts of an AI code security stack that support both frameworks.