Who the CRA applies to
The CRA addresses manufacturers, importers and distributors of products with digital elements made available on the EU market. The European Commission writes that products not made available on the market are not covered, and that open source counts under conditions.
Whether your product falls under it depends on what you make and how you offer it. We aren't lawyers: read the Commission's explanation and take legal advice if needed.
What the CRA asks of manufacturers
The Commission lists, among other things, a cybersecurity risk assessment, and a duty to report vulnerabilities and severe incidents: an early warning within 24 hours and a main notification within 72 hours. The regulation also asks you to keep track of the components in your product, among other things with a software bill of materials (SBOM).
Which evidence from your code and CI helps
A check doesn't make you compliant, but the questions can be answered with evidence:
- Which components have a known vulnerability, from your lockfiles
- Whether there are secrets in your code or history
- Whether tests ran before a release: we read the evidence from your own CI
- Whether it is described how you handle vulnerabilities and how you recover after an outage
What we don't do
We don't assess your product for CE marking, don't do a conformity assessment and don't report anything to a regulator. We don't deliver an SBOM either. You get findings with proof; what you do with them is up to you.