Industry executives and experts share their predictions for 2026. Read them in this 18th annual VMblog.com series exclusive.
By Mark Lambert, Chief Product Officer, ArmorCode
Most global software makers still underestimate how profoundly the EU Cyber Resilience Act (CRA) will reshape how digital products are built, secured, and delivered. While the regulation officially took effect in late 2024, its most consequential milestones loom just ahead. Beginning in September 2026, organizations selling software into the EU must report exploited and/or severe vulnerabilities within 24 hours. By December 2027, they must be able to demonstrate secure-by-design practices, maintain tamper-proof SBOMs, document security across their product lifecycles, and prove they have continuous vulnerability management and rapid disclosure workflows.
For many companies, these expectations represent a fundamental reordering of how software is produced. The challenge will be both regulatory and architectural. In 2026, as companies scramble to prepare, they will discover massive visibility gaps in their software inventories, dependencies, and supply chains. CRA will force a reckoning, and for many, it will be painful.
Why the CRA Will Blindside Software Makers
The biggest surprise for global vendors will be that the CRA applies to far more organizations than expected. Any “product with digital elements,” from mobile applications and embedded systems to IoT devices and cloud-connected services, falls under its rules. That inclusiveness means the CRA’s 24-hour disclosure mandate, SBOM requirements, and governance expectations are not limited to a niche group of mature companies. They apply to almost everyone doing business in the EU.
Yet most organizations still do not have an accurate, continuously updated inventory of what they build, what open-source components they rely on, which vulnerabilities are exploitable in their specific product context, or how quickly their teams can respond. Even fewer have the lifecycle documentation and audit trails that the CRA treats as table stakes. This year, leaders will discover their internal assumptions about “good enough” security hygiene are incompatible with a regulation designed around speed, transparency, and chain-of-custody accountability.
The rise of AI-generated code and AI embedded into products will make this compliance challenge even greater. As more developers integrate generative assistants into their workflows, organizations will be required to prove code provenance and demonstrate that they can trace risks back to their source. Many teams cannot do that today, and CRA requires that they must.
The Compliance Burden Will Expose Structural Weaknesses in Security Operations
Preparing for CRA compliance requires unified vulnerability management across code, infrastructure, cloud and AI. In practice, many companies still rely on fragmented workflows. Scanning tools operate in isolation, triage is handled manually, engineering teams are stretched thin, and security leaders lack a real-time view of risk across their product portfolios.
In 2026, these operational gaps will collide with CRA’s timelines. Meeting a 24-hour disclosure requirement is impossible if it takes days just to assemble an inventory of findings. Proving “secure throughout lifecycle” is unachievable if you cannot track remediation progress or SLA adherence across teams. Demonstrating secure-by-design principles is difficult if AI-assisted code development lives outside existing governance structures.
This is where much of the industry will feel blindsided. Not because the rules are unreasonable, but because their internal security posture is far less mature than they assumed. CRA has effectively raised the baseline for what it means to operate a credible software organization in the global market.
AI Will Become Both the Problem and the Only Scalable Solution
AI-generated code is accelerating development, but it is also introducing uncertainty. Proving code lineage, verifying open-source integrity, and understanding the dependencies embedded in auto-generated outputs will become mandatory. In 2026, more organizations will realize they need AI on the defensive side as well. This includes AI correlation to cut through the noise of billions of findings, AI-powered remediation suggestions to reduce MTTR, AI assistants that understand both regulatory frameworks and code dependencies, and AI-driven documentation workflows that can produce CRA-ready reports instantly.
The organizations that pair automation with governance, bring together inventory management, SBOM generation, continuous monitoring, exception oversight, SLA tracking, and disclosure workflows in one place will be best prepared to answer CRA requirements.
2026 Will Separate Companies That Build for the Future from Those That React Too Late
The next year is the last opportunity for global software makers to prepare before full CRA enforcement arrives. Those who treat CRA as a catalyst will gain a meaningful competitive edge. Organizations that can prove their security posture, demonstrate transparency across their supply chains, and automate rapid response will not only meet regulatory expectations but also strengthen trust with customers and regulators alike.
By 2026, the Cyber Resilience Act establishes a new operating baseline for software companies in a digital economy built on transparency, accountability, and secure-by-design practices. Those that focus now on visibility, unified vulnerability management, and modernized security operations will strengthen their long-term resilience.
Those that wait will find themselves scrambling against the clock, competing for the same scarce security resources, and struggling to build systems they should have started years earlier. The countdown has already begun.
##
ABOUT THE AUTHOR
Mark Lambert is the Chief Product Officer for ArmorCode, a leading application security posture management (ASPM) provider. Mark has built products for more than 20 years, and helped organizations streamline the delivery of secure, reliable and compliant software applications across the enterprise, embedded and IoT markets.
Prior to ArmorCode, he held product leadership positions with Parasoft, Advanced Visual Systems (AVS) and more. Mark holds a bachelor’s and master’s degree in computer science from Manchester University, UK.
