01
What did we ship?
Commit, artifact, version and SBOM for the exact release.
CRA Evidence Pilot
Turn one real software release into a CRA evidence record.
A focused two-week working session to connect your release, SBOM, known vulnerabilities, decisions and technical proof in one traceable record.
One product · One real release · Two weeks
The release record
Four questions your team should be able to answer.
A practical release record keeps the engineering facts, human decisions and technical proof together without pretending to be a legal conclusion.
02
What did we know then?
Components and known vulnerability observations at that point in time.
03
What did we decide?
Assessment, remediation, verification and accountable history.
04
What can we show?
A traceable technical record and a downloadable evidence package.
Why a release record
Stop reconstructing the story when someone asks a question later.
Without a release record
- Facts are spread across Git, scanners, tickets and people.
- A question means reconstructing history under pressure.
- It is unclear who knew what and who made the decision.
With CRA Operations
- One release connects source, SBOM, observations and decisions.
- Open the record for that exact release.
- The technical history remains traceable.
What the pilot includes
No extra administration for the sake of administration.
We start with the GitHub or GitLab repository, CI/CD, SBOM and security process your team already uses. People add the human judgement only where it is needed.
- One software product and one real release.
- Release provenance and existing engineering or security evidence.
- Retained evidence, mapping and a factual gap overview.
- Evidence package, integrity verification and signature history.
- A closing review with your technical owner.
The useful distinction
“What did we actually know about this exact release at that moment?”
The pilot answers that technical evidence question. It does not certify a product, replace legal advice or turn a dashboard into a compliance conclusion.
Free practical guide
From Software Release to CRA Evidence
A practical, eight-page guide to help software teams understand the release-evidence model before a pilot conversation.
The guide is practical product-security information, not legal advice, certification or a CRA conformity determination.
In this guide
- CRA context and key dates
- A release-bound evidence model
- A practical evidence-readiness checklist
Download the guide (PDF)
English PDF · 8 pages · 1.2 MB
Apply for a pilot conversation
See whether your next release is a fit.
We are looking for a small number of software manufacturers that release regularly, serve the EU market and want to make their existing technical evidence easier to retain and revisit.
We use these details only to prepare the conversation and follow up on this request.
Product → Release → Evidence → Proof
No reconstructed history, no generic compliance score, and no legal conclusion disguised as a dashboard.