Beyond the Release: Managing Long-Term Risk and Compliance in Embedded Linux with Yocto

Beyond the Release: Managing Long-Term Risk and Compliance in Embedded Linux with Yocto

The embedded systems of the future will be judged by their long-term resilience and security. For many manufacturers, however, the shift from a product release to continuous lifecycle management is a significant operational hurdle.
Regulations like the EU’s Cyber Resilience Act (CRA) are formalizing this challenge, demanding ongoing vulnerability management and creating a backdraft of responsibility that impacts the entire supply chain.

This presentation highlights that a robust and reproducible build system is the cornerstone of any sustainable product strategy in this new environment. It will explore how the Yocto Project provides the essential framework for building future-proof and maintainable systems.
The discussion will cover how its architecture enables the critical features needed to manage long-term risk: full-stack patchability for targeted CVE fixes, reproducible builds for maintaining legacy devices, and automated Software Bill of Materials (SBOM) generation for regulatory transparency.
Attendees will gain actionable strategies for implementing lifecycle-aware embedded development and transforming existing product portfolios to meet evolving regulatory requirements.

Presented at

  • Embedded World Conference, Nuremberg, 2026-03-10
  • EmBO++, Bochum, 2026-03-20
Download slides

Related Posts

LoRaWAN in theory and practice: A trip through Munich

LoRaWAN in theory and practice: A trip through Munich

LoRaWAN (Long Range Wide Area Network) is becoming increasingly popular, thanks in part to public networks such as The Things Network, which allow users to dispense with their own gateways. LoRaWAN also promises potential in terms of range and energy efficiency. But how does the standard perform in practice?

The aim of the presentation is to shed light on the technical background and demonstrate how practicable LoRa is in the field using real tests. It will be shown how the standard behaves in urban and rural areas, how differences in height of the gateway and different antennas influence the transmission quality.

Read Post
Embedded World 2024

Embedded World 2024

While I’m a regular visitor of the Embedded World Exhibition, this year was different. I had not only a more business-focused visit with lots of meetings with old and new partners and customers, but I also had the chance to serve rather spontaneously as a speaker, or better “Table Captain,” at the second edition of Embedded World’s women networking event #women4ew. Thus, I want to recap both parts separately and make a reference to what changed in contrast to my experiences outlined in the recently published post on International Women’s Day.

Read Post
Yocto on the Edge - Unusual challenges when building not so embedded systems

Yocto on the Edge - Unusual challenges when building not so embedded systems

Building embedded systems with Yocto on ARM platforms is a common practice, but when the products move further to the edge and become less “embedded,” new challenges arise. In this session, we will explore the requirements and challenges faced when developing Yocto-based systems for edge computing based on Intel.

We will dive into topics such as provisioning x86-based platforms, securely managing Linux user logins on a read-only root file system with enforced password changes, and implementing A/B updates together with secure boot. Real-world project requirements will be used as a guide to discuss practical solutions and best practices for addressing these challenges.

Read Post