SBOM · Licensing · Vulnerabilities · Supply chain
One CRA reference, two readings: Legal and Cybersecurity
Regulation (EU) 2024/2847 requires a software bill of materials and a vulnerability handling process for every product with digital elements placed on the Union market. This site defines the framework once, then translates it into concrete obligations for each team.
Where to start
Legal
I work in Legal / Compliance
CE marking, technical documentation, EU declaration of conformity, reporting deadlines, supplier clauses, licensing and evidence retention.
Cyber
I work in Cyber / DevSecOps
Automated SBOM generation, CI/CD integration, VEX, coordinated disclosure, continuous monitoring and the 24-hour reporting procedure.
Leadership
I sit on the leadership team
Risk exposure, the cost of compliance, the decisions to arbitrate and how far the product portfolio has progressed.
The binding timeline
deadline passed
Notified bodies: the chapter on notification of conformity assessment bodies applies
in 22 days
Reporting: the Article 14 obligations apply, including to products already on the market
in 478 days
Full application: CE marking, technical documentation, SBOM and support period
Countdown frozen at the site build date: August 20, 2026.
The three pillars of this reference
The regulatory framework
The text, its scope, its exclusions, the four criticality classes, the support period and the status of open source. Defined once, cited everywhere else.
Obligations and risks
What the Regulation requires of Legal and of Cyber, what each must produce, and what they are exposed to if they do not.
Organisation and tooling
The difference between generating an SBOM in the build chain and steering the portfolio from a central platform — two levels, two toolsets, two owners.
All sections
Cross-cutting
Start here
How this site is organised, which reading path suits your team, and the fifteen terms to know before opening the Regulation.
Cross-cutting
The CRA framework
Regulation (EU) 2024/2847: identity of the text, scope, exclusions, criticality classes, essential requirements, support period, open source, reporting, timeline and penalties.
Cross-cutting
SBOM
The software bill of materials: definition, CRA requirement, CycloneDX and SPDX formats, types, quality, identifiers, VEX, SPDX licensing, signing, distribution and life cycle.
Cross-cutting
Open source licensing
The families of free software licences, what actually triggers their obligations, and nine real distribution scenarios — from SaaS backend to connected device — with the verdict per family.
Legal
Legal path
CRA obligations seen from Legal and Compliance: CE marking, technical documentation, EU declaration, reporting, penalties, contracts, licensing, support and evidence retention.
Cyber
Cyber path
CRA obligations seen from Cybersecurity and DevSecOps: SBOM generation, CI/CD, secure by design, vulnerability management, coordinated disclosure, reporting, continuous monitoring.
Cross-cutting
Organisation
Two tooling levels, a target architecture, a RACI matrix, governance bodies, a Legal-Cyber interface contract, metrics and a roadmap.
Cyber
Tooling
The two tooling families: SBOM generators inside the build chain, and platforms for steering the portfolio. Profiles, comparison and selection criteria.
Leadership
Leadership
The CRA in five minutes for an executive committee: market access exposure, financial exposure, decisions required and current progress.
Cross-cutting
Resources
The templates, models, registers, checklists and response cards to reuse: technical documentation, EU declaration, user notice, CVD policy, reporting templates, contract clauses.
Cross-cutting
Worked scenarios
Ten end-to-end scenarios: the Legal question, the Cyber question, the decision, the evidence produced and the lesson.
Cross-cutting
Self-assessment
A five-module grid to locate your maturity, identify priority gaps and measure progress from one quarter to the next.
Cross-cutting
Glossary
The CRA and SBOM vocabulary, with the French equivalent where it differs, and a pointer to the reference page.
Cross-cutting
Frequently asked questions
Forty short answers to the questions Legal and Cyber teams ask most, each pointing to the reference page.
Cross-cutting
Regulatory watch
What is still moving: harmonised standards, delegated and implementing acts, designation of national authorities. The mechanism that keeps this site from becoming wrong.
Cross-cutting
Vulnerability disclosure
This site's coordinated disclosure policy: scope, reporting channel, response commitments, safe harbour and recognition of researchers.
Cross-cutting
About this site
Purpose, scope, editorial governance, legal disclaimer, technical principles and legal notices.
Cross-cutting
Contact
One address: report an error, suggest content, ask a question — and what this site does not do.