Who does the Cyber Resilience Act apply to?

Manufacturers, importers and distributors placing products with digital elements on the EU market — hardware and software that can connect to a device or network, which includes most embedded and IoT products.

When does the CRA come into force?

It entered into force in 2024. The vulnerability and incident reporting obligations apply from 11 September 2026, and all essential requirements from 11 December 2027.

Does the CRA require an SBOM?

Yes. Manufacturers must identify and document the components of their products in a software bill of materials. Yocman's sbom command checks the SPDX SBOM your Yocto build produces, and cra report includes it.

Does Yocman make my product CRA compliant?

No, and no tool can on its own. Compliance is a legal assessment of your whole product and processes. Yocman produces the build-side evidence — CVEs, SBOM, secrets, hardening — that an assessment relies on, and clearly marks what is out of build scope.

Does the CRA apply to open-source software?

Open-source software developed or supplied outside a commercial activity is largely out of scope, but a manufacturer that puts a product with open-source components on the market is responsible for that product. Using the Yocto Project does not change your obligations.

Cyber Resilience Act

The Cyber Resilience Act for your embedded Linux, in one report

The EU Cyber Resilience Act makes vulnerability handling, an SBOM and security updates mandatory for products with digital elements. Yocman turns your Yocto build into the build-side evidence you need — unpatched CVEs, embedded secrets, SBOM, hardening — with a single command.

Get started free Read the cra report guide

The deadlines are close

11 Sep 2026
Reporting of actively exploited vulnerabilities and severe incidents starts.
11 Dec 2027
All essential requirements apply to products placed on the EU market.

yocman cra report

$ yocman cra report --format md -o cra.md

Build-side readiness 4/6 provable areas with no gap, 1 gap, 1 to review

Gap Known vulnerabilities CVE-2099-0101 (CVSS 9.8) in openssl

Review SBOM SPDX present, 2 components unmatched

No gap Confidentiality no embedded secret

No gap Minimal attack surface no telnet, no empty password

Manual Update mechanism · Disclosure document your policy (out of build scope)

✓ wrote cra.md

Demo build; CVE identifiers are fictitious.

What the CRA requires

The CRA (Regulation (EU) 2024/2847) covers almost any product with digital elements sold in the EU — including embedded and IoT devices. Manufacturers must ship products with no known exploitable vulnerabilities, keep a software bill of materials, deliver security updates, and handle and disclose vulnerabilities over the product's lifetime.

No known exploitable vulnerabilities at release
A software bill of materials (SBOM)
Security updates, secure by default, minimal attack surface
Vulnerability handling, coordinated disclosure and documentation

Each requirement, mapped to evidence from your build

yocman cra report reuses the analyses you already run and reorganises their findings by CRA requirement area, with a status, the evidence and the command behind it.

CRA requirement (Annex I)	What Yocman proves from your build	Command
Known vulnerabilities	Unpatched CVEs in the image you ship, by CVSS	yocman cve
Software bill of materials	SPDX SBOM present and consistent with the image	yocman sbom
Confidentiality of data	No private keys, tokens or passwords baked into the rootfs	yocman secrets
Minimal attack surface	No insecure services, empty passwords or extra root accounts	yocman services · users
Hardening	The kernel .config against a hardening checklist	yocman kernel-audit
Component documentation	Licenses and source obligations of the image	yocman licenses

What Yocman does not claim

Yocman gives you the build-side evidence. It does not certify compliance, and some CRA obligations cannot be proven from a build — the report marks them clearly instead of pretending.

It is evidence for an audit, not a conformity assessment or a CE marking
Your update mechanism (signing, rollback, delivery) stays your responsibility
The disclosure policy, the point of contact and the user documentation are yours to provide

Generate your CRA evidence report

Free plan included, no credit card. Point it at your build and get a Markdown report to attach to your file.

$pipx install yocman

Get started free

Cyber Resilience Act FAQ

Who does the Cyber Resilience Act apply to?: Manufacturers, importers and distributors placing products with digital elements on the EU market — hardware and software that can connect to a device or network, which includes most embedded and IoT products.
When does the CRA come into force?: It entered into force in 2024. The vulnerability and incident reporting obligations apply from 11 September 2026, and all essential requirements from 11 December 2027.
Does the CRA require an SBOM?: Yes. Manufacturers must identify and document the components of their products in a software bill of materials. Yocman's sbom command checks the SPDX SBOM your Yocto build produces, and cra report includes it.
Does Yocman make my product CRA compliant?: No, and no tool can on its own. Compliance is a legal assessment of your whole product and processes. Yocman produces the build-side evidence — CVEs, SBOM, secrets, hardening — that an assessment relies on, and clearly marks what is out of build scope.
Does the CRA apply to open-source software?: Open-source software developed or supplied outside a commercial activity is largely out of scope, but a manufacturer that puts a product with open-source components on the market is responsible for that product. Using the Yocto Project does not change your obligations.

Official references

This page is general information, not legal advice. Yocman is an independent tool, not affiliated with or endorsed by the European Union, ENISA, the Yocto Project or The Linux Foundation. Yocto Project® is a trademark of The Linux Foundation.