CRA compliance will be judged by the binary you ship

Focusing on the EU Cyber Resilience Act (CRA), compliance requires examining the shipped binary and its artifacts rather than relying solely on documentation. Regulations require manufacturers to report actively exploited vulnerabilities and severe incidents in products already on the market, including legacy releases. Compliance necessitates analyzing properties embedded within the shipped bytes, such as exploitation mitigation controls like ASLR and data execution prevention, which are not captured in standard questionnaires. Furthermore, an accurate Software Bill of Materials (SBOM) is crucial, as build-system SBOMs often omit components that are statically linked or repackaged, leading to gaps in identifying all components. The consequences of relying only on paperwork are liability, as external parties can analyze the artifact to assess compliance. Evidence from the final artifact supports specific obligations like component inventory and known vulnerabilities, but it does not fully cover risk assessment or development process documentation.

The narrative pivots on shifting the burden of proof from static documentation to dynamic artifact analysis as the only reliable measure of compliance. The core pattern involves a conflict between administrative accountability (paperwork/declarations) and material reality (the binary). This creates a high-stakes friction point where theoretical compliance clashes with verifiable runtime behavior, forcing entities into a reactive position: either substantiating claims through exhaustive, artifact-level evidence or facing liability from external scrutiny. The implication is that obfuscation through layer separation—distinguishing between what the build process *knows* (SBOM) and what the binary *is* (artifact)—becomes a central battleground for accountability in emerging regulatory frameworks like the CRA. The pattern of exposing the gap between intent and outcome suggests that future compliance systems will heavily favor verifiable execution evidence over self-attested policy statements. The missing piece is how this artifact-centric approach scales across diverse supply chains without creating prohibitive operational overhead, which necessitates a deeper inquiry into harmonized standards versus demonstrated outcomes.