CRA Evidence Pilot
CRA Evidence Pilot FAQ
Answers to practical questions about the CRA Evidence Pilot.
Is this a CRA certification?
No. The pilot organises factual technical evidence for one release. It does not provide certification, legal advice or a conformity determination.
What is the Cyber Resilience Act?
The CRA is EU Regulation 2024/2847. It introduces cybersecurity requirements for products with digital elements made available on the EU market. Read our factual CRA introduction for the timeline and context.
Does the CRA apply to our company?
The CRA can apply to a broad range of hardware and software products with digital elements made available on the EU market. Applicability depends on the facts of the product and its route to market. We do not provide a legal scope determination.
When do the main CRA obligations apply?
The main obligations apply from 11 December 2027. Reporting obligations for actively exploited vulnerabilities and severe incidents apply from 11 September 2026. The official EU implementation timeline provides the current detail.
Do we need to replace Git or CI/CD?
No. The pilot starts from the repository, CI/CD and security evidence your team already uses.
Can CRA Operations submit an Article 14 report for us?
No. CRA Operations records technical evidence and authorised decisions. It does not automatically submit regulatory reports or replace the responsible manufacturer.
What technical sources can we bring?
A repository reference, release or artifact information, a CycloneDX SBOM and existing security or engineering evidence are useful starting points.
Can we use GitHub or GitLab?
Yes. GitHub and GitLab repository provenance are supported. GitHub Actions and GitLab CI can submit repository-scoped evidence after an owner configures a supported credential. CRA Operations complements existing engineering workflows rather than replacing them.
Who should join the pilot?
A technical owner who understands the product and release process is essential. A security or product representative is often useful as well.
What do we receive at the end of the pilot?
A bounded, release-specific technical evidence record and a factual review of what was retained. It is not a certificate, compliance score or legal opinion.
Do you store our source code?
The pilot is designed around retained technical evidence and references. The exact data scope is agreed during intake; we do not present external references as retained files.
What happens to our inquiry details?
We use them to prepare and follow up on a pilot conversation. Read the pilot inquiry privacy notice for the details.
One product. One real release. Two weeks.
Request a pilot conversation