CRA Compliance with embtrace
The EU Cyber Resilience Act requires manufacturers of products with digital elements to provide SBOMs, vulnerability management, and technical documentation. Non-compliance carries penalties of up to €15 million or 2.5% of global annual turnover.
Radio equipment: this already applies today
Anyone placing devices with Wi-Fi, Bluetooth or cellular connectivity on the EU market has
been required since 1 August 2025 to keep a documented list of the
security-relevant software and hardware components and to match it continuously against
known vulnerabilities — under the harmonised standard EN 18031
(requirement GEC-1). The basis is Delegated Regulation (EU) 2022/30 to the Radio
Equipment Directive, which activated the cybersecurity requirements.
The standard does not use the term “SBOM” — substantively it is the same
groundwork the CRA formalises from 2027. And the work is done only once: the Delegated
Regulation is repealed with effect from 11 December 2027
(Delegated Regulation (EU) 2026/339), with the CRA taking over seamlessly.
CRA Requirements → embtrace Commands
Complete mapping: which CRA article is addressed by which embtrace command.
| CRA Requirement | Article | embtrace Feature | Command |
|---|---|---|---|
| Machine-readable SBOM | Art. 13(15) | SBOM generation (CycloneDX/SPDX) | embtrace sbom generate |
| SBOM of all top-level deps | Annex I, Part II(1) | Yocto/Buildroot import + merge | embtrace sbom import + merge |
| Vulnerability management | Art. 13(6) | CVE scanning + VEX lifecycle | embtrace sbom vuln |
| Detect active exploitation | Art. 14 (precondition) | CISA KEV lookup + EPSS probability | embtrace sbom vuln --exploit-intel |
| 24h ENISA notification | Art. 14(2) | ENISA report generator | embtrace comply enisa-report |
| 5-year security support | Art. 13(8) | Support period in config | embtrace comply audit --policy cra |
| Technical documentation | Art. 31, Annex VII | Automatic documentation generation | embtrace comply documentation |
| 10-year record keeping | Art. 31(2) | Release archive with manifest | embtrace release create |
| Secure updates | Annex I, Part I(3) | Signed update packages (Ed25519) | embtrace update create --sign |
| Traceability | Annex I, Part II(1) | Release manifest (Git→Build→Release) | embtrace release create |
BSI TR-03183 — Technical Guideline
The German Federal Office for Information Security (BSI) has defined concrete technical requirements for SBOM and vulnerability management in TR-03183 v2.1.0. embtrace supports this as a standalone policy.
Mandatory SBOM fields (TR-03183)
- Component name
- Version number (exact, no range)
- Manufacturer / Supplier
- Licence (SPDX Licence ID)
- Package URL (PURL)
- Cryptographic hash (SHA-256)
embtrace command
# BSI TR-03183 policy audit embtrace sbom audit \ --sbom product-sbom.cdx.json \ --policy bsi-tr-03183 ✓ name: 100% (47/47) ✓ version: 100% (47/47) ⚠ supplier: 95% (45/47) ✓ license: 100% (47/47) ✓ purl: 100% (47/47) Overall: YELLOW Exit code: 2
Liability Protection Through Documentation
The EU Product Liability Directive (2024/2853) reverses the burden of proof: manufacturers must demonstrate that they managed vulnerabilities professionally.
Without Documentation
A device is compromised. The manufacturer cannot produce an SBOM, CVE documentation, or patch history.
Court presumes defectiveness
The manufacturer must prove otherwise — practically impossible without records.
With embtrace
The manufacturer presents: SBOM, CVE history, VEX documents, patch history, audit reports — generated automatically with every release.
Proof of professional vulnerability management
“We knew what was in our product and assessed and documented every CVE.”
The evidence chain — automated with embtrace
sbom generate
sbom vuln
release create
comply audit
Unsure whether your product is subject to the CRA?
Contact us for a free initial assessment. We will help you understand which CRA requirements apply to your product and how embtrace addresses them.
Free initial assessment →