The CRA expects you to know what your product is made of.
For anyone who makes, imports or integrates products with digital elements: HodeiShield ingests a supplier's or your own SBOM, cross-checks it against CVEs and alerts you per component. It does not replace your technical documentation or your notification.
- SBOMs as JSON only (CycloneDX or SPDX), via authenticated upload
- Data in the EU (OVH, Gravelines); Cloudflare (US) handles DNS, CDN and TLS on the request path
What the CRA requires, in brief
The CRA sets cybersecurity requirements for products with digital elements across their whole life cycle.
Informational summary, not legal advice. Whether your product is in scope, and in which category, depends on the official text.
- Know what it is made of
- The manufacturer identifies and documents the product's vulnerabilities and components, including a software bill of materials (SBOM) in a commonly used, machine-readable format (Annex I, Part II).
- Diligence with third-party components
- Whoever integrates third-party components must exercise due diligence so that they do not compromise the product's cybersecurity (Article 13).
- Fix and report
- Vulnerabilities are remediated without delay, including through security updates (Annex I, Part II). Actively exploited vulnerabilities and severe incidents affecting the product's security are notified simultaneously to the coordinating CSIRT and to ENISA through the single reporting platform, with an early warning within 24 hours (Article 14).
- Document and mark
- Technical documentation, conformity assessment and CE marking, depending on the product's category. A cloud service on its own (SaaS) is in principle outside its scope, but the remote processing a product needs in order to work is part of that product (Article 3(2), recitals 11 and 12).
From the SBOM to component evidence
The steps the platform covers and the ones that remain yours.
1
Not coveredGet the SBOM
Your build produces it or your supplier hands it over. HodeiShield does not generate it from source code.
2
DirectAuthenticated upload
A CycloneDX or SPDX JSON SBOM, linked to a supplier or to an asset of your own.
3
DirectCross-check with CVEs
Components are checked against OSV.dev and the daily CVE and CISA KEV sync.
4
DirectPer-component alert
A CVE that affects a component becomes an alert tied to the supplier, routed to your destinations.
5
DirectInventory and download
The components and their CVE status stay queryable per supplier, and the original SBOM can be downloaded.
6
Not coveredWhat stays on your side
Technical documentation and CRA notification: fixing, reporting to ENISA or the CSIRT and maintaining the file.
The SBOM is never attested: the Trust Center does not sign its content.
From each CRA obligation to a HodeiShield capability
With the phase of the cycle and the real scope of each one.
Direct: the platform does it. Partial: it supplies evidence or one part, the rest is yours. Not covered: outside HodeiShield.
- Obligation:
Identify and document components, including an SBOM
Annex I, Part II
What HodeiShield does:Ingests and analyses the SBOM of a supplier or of an asset of your own. It does not generate it from source code.
Docs · SBOM, CVE and alert chain (opens in a new tab)PhaseSENSEScopePartial - Obligation:
Address vulnerabilities without delay
Annex I, Part II
What HodeiShield does:Per-component alerts with CVE, KEV, exploitation likelihood (EPSS) and blast radius. Alerts route to 9 destinations and notify or open a ticket in your system according to your rule. It is not remediation.
Docs · Connectors (opens in a new tab)PhasePREDICTACTScopePartial - Obligation:
Know whether a vulnerability is actively exploited
Art. 14
What HodeiShield does:Flags components with a CVE in the CISA KEV catalogue. Reporting to ENISA and the CSIRT is yours.
Docs · Risk engine (opens in a new tab)PhaseSENSEScopePartial - Obligation:
Due diligence on third-party components
Art. 13
What HodeiShield does:Supplier questionnaires, periodic external scanning and SBOMs in the same declared-dependency graph.
Docs · SBOM, CVE and alert chain (opens in a new tab)PhaseSENSEPREDICTScopePartial - Obligation:
Gather component evidence
Annex VII
What HodeiShield does:Each SBOM's component inventory with its CVE status, and download of the original SBOM. It is not the technical documentation or the EU declaration of conformity.
Docs · SBOM, CVE and alert chain (opens in a new tab)PhaseSENSEScopePartial - Obligation:
Coordinated vulnerability disclosure policy
Annex I, Part II
What HodeiShield does:Outside HodeiShield.
PhaseOutside the cycleScopeNot covered - Obligation:
Conformity assessment, EU declaration and CE marking
Ch. III
What HodeiShield does:Outside HodeiShield.
PhaseOutside the cycleScopeNot covered
What HodeiShield does not do with the CRA
What to expect and what not.
It does not generate your SBOM
It ingests CycloneDX or SPDX JSON SBOMs. It does not build them from your repository or your build.
It does not report to ENISA or a CSIRT
It tells you which components have CVEs and which are in KEV. Reporting actively exploited vulnerabilities and severe incidents is yours.
It does not replace technical documentation or CE marking
The inventory gathers component evidence. Conformity assessment and the EU declaration stay with the manufacturer.
It does not monitor continuously
The CVE sync is daily and the cross-check runs on the SBOM you uploaded. An outdated SBOM gives an outdated result.
Questions about the CRA
For manufacturers, importers and integrators.
Does HodeiShield generate my product's SBOM?
No. It ingests CycloneDX or SPDX JSON SBOMs that you upload or that a supplier gives you, cross-checks them against CVEs and alerts per component.
What component evidence does it give?
Each SBOM's component inventory with its CVE status, and download of the original SBOM. It is not your technical documentation or the EU declaration of conformity.
When does the CRA apply?
Regulation (EU) 2024/2847 entered into force on 10 December 2024. The rules on conformity assessment bodies (Chapter IV) apply from 11 June 2026; manufacturers' reporting obligations (Article 14) from 11 September 2026, also to products placed on the market before 11 December 2027; and the rest from 11 December 2027 (Articles 69 and 71).
I only use third-party software. Does it affect me?
The CRA addresses manufacturers, importers and distributors of products with digital elements. If you only use software, it reaches you through your suppliers and through supply-chain duties such as those in NIS2.
Is the SBOM attested?
No. The SBOM is used to detect CVEs and raise alerts, but the Trust Center does not sign its content.
Upload an SBOM and see which components expose you
In the demo we ingest a sample SBOM, cross-check it against CVEs and reach the component inventory.
No commitment. Sample data.