We build connected industrial sensors that run embedded Linux and are sold across the EU. When the Cyber Resilience Act (Regulation (EU) 2024/2847) entered into force on 10 December 2024, our product, firmware and support teams all asked the same question: what do we actually have to change, and by when? We spent the following weeks reading the regulation itself and mapping it onto our build system. This post is that mapping, written for engineers rather than lawyers. Two caveats up front. This...