Requirement regimes (optional; CRA available today)

Runs assess CRA unless none is chosen; views are opt-in. This page documents every command in the regimes group, in the order sbomflow help regimes lists them. Each command's section is generated from the command itself — its summary, description and options from the parser, and its reads, writes, exit codes, examples and see-also from the command catalog — so it says exactly what sbomflow <command> --help says. Every example below is executed offline by the test suite, and every non-zero exit code is either produced by an executed probe or carries a recorded reason why no offline probe can produce it.

See the CLI overview for how the thirteen groups fit together and the command reference for every command's options in one place.

Overview#

Nothing in this group runs unless you choose a regime. regime-view and regime-profile work with requirement-regime profiles; emit-user-info, standards-view and the validate-*-model / validate-graph commands are the EU CRA views available today, described in CRA. Their outputs are engineering gap assessments and UNSIGNED DRAFTs, never a conformity claim.

Every regime id SBOMFlow ships is listed in one packaged regime registry: cra (a requirement regime), none (no requirement regime, by your choice), sbomflow-demo (a demonstration view profile) and cra-article-14 (the Article 14 reporting stages, which are only ever unsigned drafts). requirement_regime accepts cra or none; regime-view --regime accepts the packaged view profiles; a profile you author yourself can use any id the registry does not list. sbomflow schema and sbomflow help warning mark the artifact families and warning codes that belong to the cra regime, so a run under none — or under a regime you describe in your own profile — can tell them apart from the engine's own. The registry names regimes; it carries no requirement text and states nothing about any product.

Who this is for: integrators, process owners, CRA leads and radio-equipment leads.

`sbomflow regime-view`#

Read an existing verified pack through a versioned regime profile (read-only).

text

Read a finished, verified output directory through one versioned regime
profile, a packaged profile id or a local profile file, and write what
that profile asks against what the pack observed. The pack is never
modified, an unknown profile id is refused rather than defaulted, and
the view is never a conformity claim.

Fact	Value
Group	`regimes` — Requirement regimes (optional; CRA available today)
Stability	stable
Regime	any
Reads	an existing output directory, which is never modified, and one regime profile.
Writes	regime-view.json (into the directory, or at --output); stdout (with --json, the same document)
`--output` names	one file
Network	offline — This command has no network-capable path.
Exit codes	`0` ok · `2` an unknown profile id or an unusable directory
Machine output	has-json — read-only view of an existing verified pack through a versioned profile; one versioned JSON document on stdout

Options

Option	Value	Default	Allowed	Required	Help
`-h, --help`	(flag)	none	—	no	show this help message and exit
`EVIDENCE_DIR`	`EVIDENCE_DIR`	none	any	yes	An analyze/audit output directory (read-only; never modified).
`--regime`	`REGIME`	none	any	no	Packaged profile id to apply: a regime profile id, not the requirement regime of the run. An unknown id is refused, never defaulted. Supply this or --regime-file.
`--output`	`OUTPUT`	none	any	no	Write regime-view.json here (file). Default: EVIDENCE_DIR/regime-view.json.
`--json`	(flag)	false	—	no	Print the view as JSON to stdout instead of writing the default file; an --output named beside it is written too, with the same document.
`--as-of`	`AS_OF`	none	any	no	Pinned timestamp recorded in the view.
`--regime-file`	`REGIME_FILE`	none	any	no	Apply a LOCAL, customer-authored profile file instead of a packaged profile id. Mutually exclusive with --regime.

Examples

Read a finished run through the packaged demo profile.

sbomflow regime-view out --regime sbomflow-demo

Print the view as JSON, at a pinned time.

sbomflow regime-view out --regime sbomflow-demo --json --as-of 2026-07-01T00:00:00Z

Read it through a local, organisation-authored profile.

sbomflow regime-view out --regime-file profile.json

Refuse a profile id nobody packaged, rather than defaulting. Exits 2.

sbomflow regime-view out --regime no-such-profile

See also: sbomflow regime-profile, sbomflow standards-view, sbomflow help regimes.

`sbomflow regime-profile`#

Author, validate, inspect and carry a LOCAL, customer-authored regime profile.

text

Work with a local regime profile an organisation authors itself: init
writes an empty profile that asks nothing yet, validate reports every
structural problem, inspect explains each selector, and export copies
the profile with a manifest to a clean directory. Offline; it writes
profile files only, never evidence, and is never legal advice or a
conformity claim. An option the chosen action does not read is named
on stderr and not applied.

Fact	Value
Group	`regimes` — Requirement regimes (optional; CRA available today)
Stability	stable
Regime	any
Reads	the profile file named, for validate, inspect and export.
Writes	regime-profile-validation.json (validate, at --output); regime-profile-manifest.json (export, with the profile, into an empty --destination); init writes the empty profile file named
`--output` names	one file
Network	offline — This command has no network-capable path.
Exit codes	`0` ok · `2` a missing or invalid profile, or a refused init
Machine output	has-json — local profile authoring kit; under `--json` every action prints one document (the profile it wrote, the validation, the inspection or the export manifest), and every action writes only profile files, never evidence

Options

Option	Value	Default	Allowed	Required	Help
`-h, --help`	(flag)	none	—	no	show this help message and exit
`{init,validate,inspect,export}`	`{init,validate,inspect,export}`	none	init, validate, inspect, export	yes	init: write an empty profile (no legal asks). validate: report every structural problem. inspect: explain each selector. export: copy the profile plus a manifest to a clean directory (never evidence).
`profile`	`profile`	none	any	yes	Profile file to write (init) or read (validate/inspect/export).
`--profile-id`	`PROFILE_ID`	none	any	no	init only: the local profile id. May not shadow a packaged profile.
`--organisation`	`ORGANISATION`	none	any	no	init only: the organisation authoring this profile. Required.
`--title`	`TITLE`	none	any	no	init only: a human-readable title for the profile.
`--destination`	`DESTINATION`	none	any	no	export only: an empty directory to write the profile and manifest into.
`--output`	`OUTPUT`	none	any	no	validate only: write regime-profile-validation.json here (file).
`--json`	(flag)	false	—	no	Print JSON to stdout instead of the text report; validate also writes an --output named beside it, with the same document.
`--as-of`	`AS_OF`	none	any	no	Pinned timestamp recorded in the output.

Examples

Write an empty local profile that asks nothing yet.

sbomflow regime-profile init profile.json --organisation 'Example Devices Ltd' --profile-id example-local --title 'Example profile'

Report every structural problem in a profile.

sbomflow regime-profile validate profile.json

Explain each selector, as JSON.

sbomflow regime-profile inspect profile.json --json

Copy the profile and a manifest to a clean directory.

sbomflow regime-profile export profile.json --destination profile-export

Refuse a local id that would shadow a packaged profile. Exits 2.

sbomflow regime-profile init profile.json --profile-id sbomflow-demo --organisation 'Example Devices Ltd'

See also: sbomflow regime-view, sbomflow help regimes.

`sbomflow emit-user-info`#

Emit an UNSIGNED CRA Annex II user-information draft from an output directory (offline).

text

Assemble an UNSIGNED DRAFT of the CRA Annex II information and instructions
to the user from an existing analyze/audit output directory.

The draft is NOT user documentation and asserts no conformity: every item is
auto_backed (observed evidence), supplied_by_manufacturer, or a loud
requires_manufacturer_input placeholder, and it stays complete: false until
every item has content.

Fact	Value
Group	`regimes` — Requirement regimes (optional; CRA available today)
Stability	stable
Regime	cra
Reads	evidence-pack.json (identity, support period, VDP and update signals) and an optional manufacturer inputs file.
Writes	user-information.DRAFT.json and user-information.DRAFT.md, an UNSIGNED DRAFT
Network	offline — This command has no network-capable path.
Exit codes	`0` ok · `2` missing or invalid artifacts
Machine output	artifact-suffices — writes the UNSIGNED CRA Annex II user-information draft files

Options

Option	Value	Default	Allowed	Required	Help
`-h, --help`	(flag)	none	—	no	show this help message and exit
`EVIDENCE_DIR`	`EVIDENCE_DIR`	none	any	yes	Directory produced by 'analyze'/'audit'.
`--inputs`	`ANNEX_II_INPUTS`	none	any	no	Optional annex_ii_inputs.json with manufacturer-supplied item content/files.

Examples

Assemble the CRA Annex II user-information draft from a finished run.

sbomflow emit-user-info out

See also: sbomflow standards-view, sbomflow validate-annexii-model, sbomflow help goal cra.

`sbomflow standards-view`#

Group an output's CRA coverage by EN 18031 section (PROVISIONAL, offline).

text

Group a finished run's CRA requirement coverage by EN 18031 section, from its
cra-coverage.json. The section mapping is PROVISIONAL engineering context, not
a harmonised-standard assessment; it writes standards-view.json, or prints it
with --json (and also writes an --output named beside it).

Fact	Value
Group	`regimes` — Requirement regimes (optional; CRA available today)
Stability	experimental
Regime	cra
Reads	cra-coverage.json in an existing output directory.
Writes	standards-view.json into the directory, or at --output; stdout (with --json, the same document)
`--output` names	one file
Network	offline — This command has no network-capable path.
Exit codes	`0` ok · `2` missing or unusable directory
Machine output	has-json — read/status surface; one versioned JSON document on stdout

Options

Option	Value	Default	Allowed	Required	Help
`-h, --help`	(flag)	none	—	no	show this help message and exit
`EVIDENCE_DIR`	`EVIDENCE_DIR`	none	any	yes	An analyze/audit output directory (reads cra-coverage.json).
`--output`	`OUTPUT`	none	any	no	Write standards-view.json here (file). Default: <output_dir>/standards-view.json.
`--json`	(flag)	false	—	no	Print the view as JSON to stdout instead of writing the default file; an --output named beside it is written too, with the same document.

Examples

Group a run's CRA coverage by EN 18031 section.

sbomflow standards-view out

Print it as JSON instead.

sbomflow standards-view out --json

Write it to a named file.

sbomflow standards-view out --output standards-view.json

See also: sbomflow regime-view, sbomflow emit-user-info, sbomflow help goal cra.

`sbomflow validate-graph`#

Validate the packaged or supplied CRA requirement graph.

text

Validate the packaged CRA Annex I requirement graph, or a supplied one,
against its schema and reference rules. The exit code is the contract: a
missing or invalid graph exits 4.

Fact	Value
Group	`regimes` — Requirement regimes (optional; CRA available today)
Stability	stable
Regime	cra
Reads	the packaged CRA Annex I requirement graph, or the graph file named.
Writes	stdout (the validation result)
Network	offline — This command has no network-capable path.
Exit codes	`0` the graph is valid · `4` the graph is missing or invalid
Machine output	human-only-by-design — packaged-model self-check; the machine contract is the exit code (0 pass, non-zero fail)

Options

Option	Value	Default	Allowed	Required	Help
`-h, --help`	(flag)	none	—	no	show this help message and exit
`[graph_path]`	`[graph_path]`	none	any	no	Optional CRA graph JSON file. Defaults to packaged Annex I graph.

Examples

Validate the packaged CRA Annex I requirement graph.

sbomflow validate-graph

A graph file that is not there fails and exits 4. Exits 4.

sbomflow validate-graph missing.json

See also: sbomflow validate-techdoc-model, sbomflow validate-annexii-model, sbomflow validate-config.

`sbomflow validate-techdoc-model`#

Validate the packaged or supplied CRA Annex VII technical-documentation model.

text

Validate the packaged CRA Annex VII technical-documentation model, or a
supplied one, against its schema and reference rules. The exit code is the
contract: a missing or invalid model exits 4.

Fact	Value
Group	`regimes` — Requirement regimes (optional; CRA available today)
Stability	stable
Regime	cra
Reads	the packaged CRA Annex VII technical-documentation model, or the file named.
Writes	stdout (the validation result)
Network	offline — This command has no network-capable path.
Exit codes	`0` the model is valid · `4` the model is missing or invalid
Machine output	human-only-by-design — packaged-model self-check; the machine contract is the exit code (0 pass, non-zero fail)

Options

Option	Value	Default	Allowed	Required	Help
`-h, --help`	(flag)	none	—	no	show this help message and exit
`[model_path]`	`[model_path]`	none	any	no	Optional Annex VII model JSON file. Defaults to packaged model.

Examples

Validate the packaged Annex VII technical-documentation model.

sbomflow validate-techdoc-model

A model file that is not there fails and exits 4. Exits 4.

sbomflow validate-techdoc-model missing.json

See also: sbomflow validate-graph, sbomflow validate-annexii-model, sbomflow analyze.

`sbomflow validate-article14-model`#

Validate the packaged or supplied CRA Article 14 reporting model.

text

Validate the packaged CRA Article 14 reporting model, or a supplied one, and
print its reconciliation summary. SBOMFlow never files a report; the model
shapes UNSIGNED DRAFTS only. A missing or invalid model exits 4.

Fact	Value
Group	`regimes` — Requirement regimes (optional; CRA available today)
Stability	stable
Regime	cra
Reads	the packaged CRA Article 14 reporting model, or the file named.
Writes	stdout (the validation result, with the model's reconciliation summary)
Network	offline — This command has no network-capable path.
Exit codes	`0` the model is valid · `4` the model is missing or invalid
Machine output	human-only-by-design — packaged-model self-check; the machine contract is the exit code (0 pass, non-zero fail)

Options

Option	Value	Default	Allowed	Required	Help
`-h, --help`	(flag)	none	—	no	show this help message and exit
`[model_path]`	`[model_path]`	none	any	no	Optional Article 14 model JSON file. Defaults to packaged model.

Examples

Validate the packaged Article 14 reporting model.

sbomflow validate-article14-model

A model file that is not there fails and exits 4. Exits 4.

sbomflow validate-article14-model missing.json

See also: sbomflow validate-graph, sbomflow case disclose, sbomflow help goal cra.

`sbomflow validate-annexii-model`#

Validate the packaged or supplied CRA Annex II information-to-users model.

text

Validate the packaged CRA Annex II information-to-users model, or a supplied
one, against its schema and reference rules. The exit code is the contract: a
missing or invalid model exits 4.

Fact	Value
Group	`regimes` — Requirement regimes (optional; CRA available today)
Stability	stable
Regime	cra
Reads	the packaged CRA Annex II user-information model, or the file named.
Writes	stdout (the validation result)
Network	offline — This command has no network-capable path.
Exit codes	`0` the model is valid · `4` the model is missing or invalid
Machine output	human-only-by-design — packaged-model self-check; the machine contract is the exit code (0 pass, non-zero fail)

Options

Option	Value	Default	Allowed	Required	Help
`-h, --help`	(flag)	none	—	no	show this help message and exit
`[model_path]`	`[model_path]`	none	any	no	Optional Annex II model JSON file. Defaults to packaged model.

Examples

Validate the packaged Annex II user-information model.

sbomflow validate-annexii-model

A model file that is not there fails and exits 4. Exits 4.

sbomflow validate-annexii-model missing.json

See also: sbomflow emit-user-info, sbomflow validate-graph, sbomflow validate-techdoc-model.

SBOMFlow documentation. Engineering release-evidence support only — not a compliance or conformity claim, and not legal advice.

Requirement regimes (optional; CRA available today)

Overview#

sbomflow regime-view#

sbomflow regime-profile#

sbomflow emit-user-info#

sbomflow standards-view#

sbomflow validate-graph#

sbomflow validate-techdoc-model#

sbomflow validate-article14-model#

sbomflow validate-annexii-model#

`sbomflow regime-view`#

`sbomflow regime-profile`#

`sbomflow emit-user-info`#

`sbomflow standards-view`#

`sbomflow validate-graph`#

`sbomflow validate-techdoc-model`#

`sbomflow validate-article14-model`#

`sbomflow validate-annexii-model`#