The boss asked: "Are we affected?" The answer took three weeks.

Mette had promised her daughter she would be at the school play that Thursday. The ticket was already in her coat pocket when a colleague sent her a link with no message, just "??". Someone had found a hidden weakness in a piece of free software that a huge share of the world's websites and gadgets use to keep information secret. It was like discovering that millions of sealed envelopes had a crack in them: anyone who knew where to look could read passwords and secret keys.

Then Henrik, the boss, appeared in her doorway with his jacket still on. "Are we in this?" Mette opened her mouth to say no, and then she closed it, because the honest answer was that she did not know. Their products were built from hundreds of ready-made parts, and nobody had ever written down which ones. So she started searching: old folders, old notes, an email to a former colleague who never replied. The phones rang. Customers wanted answers. And somewhere out there, people who had read the same news were already prying at the cracked envelopes, and they did not need weeks.

Mette missed the play. The weakness was not her fault, but not knowing was a choice her company had made years earlier without ever noticing. The Cyber Resilience Act takes that choice away. Every product must come with a list of what is inside it, like the ingredients label on a food packet, and a computer checks that list against the news every day. Henrik gets his answer in minutes. Mette makes the play.