CRA product releases and customer-specific versions
A product family can have several customer deployments, releases and forks. Evidence must identify which delivered artefact it describes.
A practical deployment map
Customer A may run Release 5.1, Customer B 5.3 with a custom module and Customer C a 5.2 fork. Link each deployment to its release, SBOM and applicable findings instead of assigning one global product status.
Backports and rollout
Record which fix was backported to which branch, which deployment received it and what test and delivery evidence is retained. Do not mark every customer remediated when only the main branch has changed.
Change review
Assess whether a customer-specific change affects product scope, core functionality, risk or the basis of conformity. Substantial modification is a separate reasoned review, not a conclusion based solely on a new version number.
Next steps
Official sources and review context
Regulation (EU) 2024/2847 · European Commission · ENISA SRP
CRA-I18N-2026-10-14-DRAFT-4
Operational tools and retained records. No legal opinion, conformity assessment, certification or confirmation of CRA compliance is generated.