Organisation

CRA compliance almost never fails on the technology. It fails on the organisation: nobody owns the decision to report, technical documentation is assembled after the product ships, and SBOMs are generated but never aggregated.

This section sets out who does what, with which tooling, on which timeline.

The starting point

One page conditions everything else: Generate and steer. It separates technical SBOM generation at application level — in the CI/CD chain, at every build — from centralisation for steering at organisation level, in a platform that re-evaluates the portfolio continuously.

The CRA requires both. Annex I, Part II, point 1 mandates the inventory; points 2, 3, 4 and 7 mandate a continuous process, which a file sitting next to an artefact cannot demonstrate.

The three trade-offs to settle explicitly

They belong to the committee, not to a team:

1. Who decides to report within 24 hours? And who decides in their absence, on a Sunday?
2. Who holds the right of veto over placing on the market when the technical documentation is incomplete?
3. Who arbitrates between “fix” and “document in a VEX” when both are defensible?

Until those three answers are written down, compliance rests on individuals rather than on a process — and will not survive the first departure.

The pages in this section

They read in order: the tooling principle, the architecture that follows from it, the split of roles, the bodies that decide, the interface contract between the two teams, the metrics that measure, and the roadmap that sequences.