CRA Reference

About this site

Primary audience:Cross-cutting

Published on · updated on

Purpose

CRA Reference is a public reference on Regulation (EU) 2024/2847, the Cyber Resilience Act, on software bills of materials (SBOM), on open source licensing and on supply chain security. It addresses two audiences whose obligations are distinct but inseparable — Legal / Compliance and Cybersecurity / DevSecOps — and leadership, for the trade-offs.

Disclaimer

This site is information only. It does not constitute legal advice.

Only the text of Regulation (EU) 2024/2847 as published in the Official Journal of the European Union is authoritative. The article and annex numbers cited here must be checked against the consolidated text before any enforceable use, and the pages in the regulatory section must be reviewed by legal counsel before being relied on against a third party.

Three matters remain open and may render some pages obsolete: harmonised standards, the Commission’s delegated and implementing acts, and the designation of national authorities. See Regulatory watch.

Tool and product names are cited to illustrate technical categories. No commercial recommendation is made, and no market information is guaranteed current.

Scope

What the site covers: the CRA regulatory framework, the SBOM as a technical and legal object, the translation into obligations for each team, and your target organisation.

What it does not cover: operational security of your information systems (which falls under NIS 2 and the security management system), personal data protection, and sectoral compliance for products outside CRA scope.

Editorial governance

Section Owner
The CRA framework Legal department
Legal path Legal department
SBOM CISO
Cyber path CISO
Tooling CISO
Organisation Executive sponsor
Leadership Executive sponsor
Cross-cutting sections CRA committee

Review cadence:

  • Quarterly for every page in the regulatory section;
  • Immediately on publication of a delegated act, an implementing act or a harmonised standard cited in the Official Journal;
  • Annually for the other pages.

Every page shows its last review date and its owning function. A page whose review date is too old should be flagged: it is a defect, not a detail.

Editorial rule

A regulatory concept is defined exactly once, in The CRA framework or SBOM. Role-based paths offer only oriented readings, with a link to the canonical page.

That is what stops the two paths from diverging, and it is the rule most easily broken.

Technical principles

This site is built on a few explicit choices:

  • entirely static, with no application server and no database;
  • no client-side JavaScript dependency, apart from the progressive-enhancement share script;
  • a single third-party request from the pages, the audience measurement described in the legal notices; any other one fails the build;
  • bilingual French / English, with strict page pairing;
  • printable: checklists and response cards come out cleanly on A4, because they will be used offline, including in a crisis room;
  • accessible: contrast, keyboard navigation, heading structure, skip link.

An index for AI agents and engines is published at /llms.txt, and the full content at /llms-full.txt.

Reporting an error

A factual error, a dead link, an out-of-date page: see Contact. Corrections to the regulatory pages take priority.

Publisher. An independent documentation resource, published on a non-professional basis and with no commercial purpose. Under Article 6 of the French law on confidence in the digital economy, the publisher’s identifying details are held by the host and disclosable to the judicial authority upon request.

Editorial contact. [email protected]

Hosting. Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, United States.

Personal data. This site requires no sign-up, sets no cookies and uses no browser storage. Traffic is measured with Cloudflare Web Analytics: every page loads a script from static.cloudflareinsights.com, which reports the URL visited, the referring page, the browser type and page-load timings. That request exposes the visitor’s IP address to Cloudflare — as hosting the site already does: the measurement adds no further recipient. It sets no cookie and no individual identifier, and enables no tracking across sites. No consent banner is shown, the measurement being limited to aggregate usage statistics.

Accessibility. This site aims to conform to the RGAA and to EN 301 549. Any access difficulty can be reported through Contact.

Intellectual property. The content is made available for information. Extracts from Regulation (EU) 2024/2847 fall under the European Union’s document reuse regime. Tool and product names cited belong to their respective owners.