CRA software supply chain — dependencies and supplier evidence
Third-party components need product context and retained evidence, not a blanket supplier-compliant badge.
Ask for the right evidence
Identify the supplier, component, version and release target. Request relevant SBOM, support, vulnerability disclosure and update information. Record what was received and what remains unknown.
Receipt is not validation
An accepted-for-record artefact means receipt and review for a stated target; it does not establish supplier identity, document authenticity, legal sufficiency or product conformity.
Close the loop
Connect supplier findings with human triage, affected releases and customer deployments. Track fixes, backports and rollout evidence. Keep missing information and expired support visible rather than treating an uploaded document as completion.
Next steps
Official sources and review context
Regulation (EU) 2024/2847 · European Commission · ENISA SRP
CRA-I18N-2026-10-14-DRAFT-4
Operational tools and retained records. No legal opinion, conformity assessment, certification or confirmation of CRA compliance is generated.