AI CodeOps

EU Cyber Resilience Act (CRA)

The EU Cyber Resilience Act sets security rules for products with digital elements sold in the EU. Its key dates, what it asks of software makers, and SBOMs.

The EU Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, sets cybersecurity requirements for hardware and software products with digital elements made available on the EU market. It covers how products are designed and built, and how their makers handle and report vulnerabilities. This page is a summary, not legal advice.

Key dates

  • 10 December 2024: the regulation entered into force.
  • 11 September 2026: reporting obligations apply. Manufacturers must report actively exploited vulnerabilities and severe incidents through ENISA's single reporting platform, with an early warning within 24 hours and a notification within 72 hours.
  • 11 December 2027: the main obligations apply.

Sources: the regulation on EUR-Lex and the European Commission's CRA page.

What it asks of software makers

Among the essential requirements, manufacturers must identify and document the components in their products, including in a software bill of materials (SBOM) in a commonly used, machine-readable format covering at least the top-level dependencies. The SBOM is part of the technical documentation.

Why it matters

The reporting duty already applies to products on the EU market, including those placed there before December 2027. Teams that ship software into the EU need to know what's in it and be able to act on a vulnerability quickly.

In AI CodeOps

AI CodeOps doesn't generate SBOMs or send CRA reports. You can record the SBOM your build produces against each project, in CycloneDX or SPDX format, and the release gate can check its licenses.

Frequently asked questions

Does the CRA require publishing an SBOM?

No. The SBOM goes in the technical documentation and is given to market surveillance authorities on request. It doesn't have to be made public.

Does AI CodeOps make my product CRA compliant?

No. It doesn't generate SBOMs or file reports. It can keep the SBOMs your build produces per project and record how each change was reviewed and approved.