CRA-oriented evidence

SBOMFlow organizes release evidence around the EU Cyber Resilience Act (CRA, Regulation (EU) 2024/2847). It helps you see and assemble the engineering evidence that CRA-related obligations concern.

What SBOMFlow maps#

• Annex I (essential requirements): SBOMFlow reports which requirement areas have observed evidence and which have gaps, for the declared product class. Gaps mean evidence not observed, not requirement unmet.
• Annex VII (technical documentation): SBOMFlow can assemble supporting technical-documentation inputs into an evidence index. Completing and judging the documentation is a human task.
• Article 14 (reporting): SBOMFlow can produce unsigned draft early-warning / notification / final-report documents for a human to review and file. SBOMFlow never submits them and never contacts a reporting platform.

Conformity assessment is out of scope#

CRA conformity-assessment routes (self-assessment vs a notified body) depend on product classification and applicable harmonised standards. SBOMFlow records the class you declare and does not choose a route for you.

EN 18031 view (provisional, thematic only)#

sbomflow standards-view <output-dir> reorganises a run's CRA coverage by EN 18031 section (writing standards-view.json) for reviewers who speak that vocabulary. It is provisional thematic context only: EN 18031 is harmonised under the Radio Equipment Directive (RED), not the CRA — harmonised standards giving a presumption of conformity with the CRA are still being developed and are not yet listed in the Official Journal. This view is not a conformity route, confers no presumption of conformity, and asserts no adequacy; the full disclaimer is carried verbatim inside the artifact.

Official sources#

Verify all dates and obligations against the primary sources:

• European Commission — Cyber Resilience Act
• European Commission — CRA reporting obligations
• European Commission — CRA conformity assessment
• EUR-Lex — Regulation (EU) 2024/2847