WisecThe CRA asks for evidence. Your CI already produces it.
Can you show, product by product, which components you ship and how you handle their vulnerabilities?
Regulation (EU) 2024/2847 applies to every product with digital elements placed on the Union market. With every build, Wisec records, signs and keeps the evidence for the part of Annex I that concerns your development chain.
One obligation already applies, the rest in 2027.
Reporting actively exploited vulnerabilities already applies. Essential requirements, conformity assessment and CE marking follow.
Entry into force
Published in the Official Journal on 20 November 2024.
Article 14 applies
Reporting of actively exploited vulnerabilities and severe incidents, with an early warning within 24 hours.
General application
Essential requirements, conformity assessment, CE marking, technical documentation.
What the text asks, what Wisec proves.
Where Wisec brings evidence, requirement by requirement. The CRA report covers those of Annex I, one product at a time.
| Reference | What is expected | The evidence Wisec produces |
|---|---|---|
| Annex I, Part II (1) | Identify and document components and vulnerabilities, including with a machine-readable SBOM. | A signed CycloneDX SBOM for every build, and a component search across the whole history. |
| Annex I, Part II (2) | Address and remediate vulnerabilities without delay. | The record of each vulnerability, from first detection to fix, with its dates. |
| Annex I, Part II (3) | Test and review the product's security regularly. | The scanners run on every build, and the inventory of what ran on each. |
| Annex I, Part II (4) | Share information about fixed vulnerabilities. | A signed OpenVEX document stating each CVE's status: not affected, affected, fixed. |
| Article 14 | Report an actively exploited vulnerability, with an early warning within 24 hours. | A search by CVE that tells you in minutes which products, branches and versions are concerned, with a signed report. |
| Annex VII | Draw up the product's technical documentation. | A report per product with its scope printed, and the SLSA provenance tied to the shipped artifact when you declare it. |
An evidence mapping, not a declaration of conformity. Wisec covers the part of Annex I that concerns your development chain. The product risk assessment, the security properties of Part I, the coordinated disclosure policy, the conformity assessment and CE marking remain yours. The CRA applies to each product: the report covers one product and says so when it covers several.
A PDF to hand over, with its scope.
Covered, partial, to address.
Computed from the share of the period's builds that carry the evidence: at least 90 %, at least 50 %, or less.
Printed on the report.
Every project by default, or those you pick. A report without a stated scope is not usable in an audit.
Your dates.
The report covers the period you choose, and states when it was produced.
Available on the Business and Pro plans. The CRA report is generated from the Compliance page, for one or several products.
Sources: Regulation (EU) 2024/2847 (OJ L of 20 November 2024) and the Commission guidelines of 27 July 2026, C(2026) 5252, which are explanatory. The harmonised standards of request M/606 are still being drafted. This is not legal advice.