Context: The EU Cyber Resilience Act (EU CRA) introduces cybersecurity obligations for products with digital elements, including secure development, vulnerability handling, software supply-chain transparency, and technical documentation. Objectives: To investigate how companies are preparing for the EU CRA, with particular attention to software supply-chain security, product security, vulnerability management, and readiness to demonstrate conformity. Methods: We conducted a qualitative interview study with nine practitioners from two large enterprises (LEs) and two small and medium-sized enterprises (SMEs) located in Sweden. The interviews covered current security practices, EU CRA interpretation, compliance planning, evidence artefacts, and organisational challenges. We analysed the material using thematic analysis. Results: The four cases show uneven EU CRA readiness. The two LE cases reused existing standards to different degrees, but one remained fragmented while integrating new product-cybersecurity routines. The two SME cases ranged from reactive developer-led security to documented workflows embedded in engineering. Across the cases, relevant artefacts existed but were not always maintained as reusable compliance evidence. Conclusion: While strategies to prepare for the EU CRA differ across companies, we propose recommendations for practitioners, tool providers, and regulators seeking to support future regulatory compliance.