CYBER RESILIENCE ACT: THE LIABILITY IS NOW ON YOU

 Qt Group's Quality Management System has been adapted for CRA compliance. In addition, Qt is ISO9001- and ISO27001-certified.

Qt Framework in general provides your development teams with building blocks for easier development of CRA-compliant & required features, and with the Qt 6.12 Commercial licenses, you can easily ensure compliance for Qt's part of your product.

In addition, compliance-considerations are a part of the daily Qt Framework feature development work. For instance, in Qt’s source code files, security critical items are marked according to the QUIP-23 process. 

 Qt Group has revised its risk management to meet the CRA requirements. The Threat Analysis & Risk Assessment is carried out whenever there’s a significant change, such as a new module or major feature, or an impactful architecture change. Each identified risk is scored for severity and likelihood, then assigned with a clear owner and tracked. The assessments are revisited whenever there are significant enough changes in the Qt libraries or APIS, whenever the threat landscape shifts, or when a new vulnerability surfaces.

 In general, the Qt API is of high quality; it is easy to use, and hard to misuse. In addition, the Qt Shared Security Model defines how the security responsibilities are divided between your team, the Qt Group, and the Qt Project.

As for meeting CRA’s technical feature requirements in your product, such as adding functionality for verifications, authentications, and more, Qt Framework provides various ready-made building blocks.

 You have a very low risk for Qt’s part of your product.

Qt Group provides guaranteed response times (SLAs) to its commercial customers.

Qt Group has the official CNA status and we publish security advisories following our processes. Commercial customers can also sign up for the Early Warning List (EWL) to be the first to hear of found security issues. For developers, the issue tracking in the Jira bug tracker provides transparency.

Qt Framework is also committed to ensuring that for the used 3rd parties, the latest libraries are always integrated in the maintained Qt releases, lowering your risk further and easing your 3rd party management.

The commercial Qt 6.12 LTS release significantly helps in ensuring your products are updateable and patchable throughout their lifecycle, even for very long product lifecycles.

Qt LTS releases allow keeping your product in production in a stable and maintained environment. Security maintenance and updates are straightforward within the 5-year support period, and when needed, you can extend that with the Extended Security Maintenance (ESM) subscription or expand it with Extended Support​ and Professional Services.

This enables maintaining proprietary software without excess use of your internal resources, which would be the case with open source alternatives. 

 Qt 6.12 Commercial provides you peace of mind with a wealth of documentation and assessment work ready-made for Qt's part of your product.

Qt can natively auto-generate a Software Bill of Materials (SBOM) during the build process to help with your CRA-compliance, vulnerability scanning, and file integrity.

In addition, Qt Framework comes with a wealth of technical documentation ready-made, easing your compliance efforts.

Qt 6.12 has been formally assessed against the CRA requirements, following Qt Group's Conformity Assessment process. The EU Declaration of Conformity for 6.12 LTS demonstrates the compliance.