Claude 
Cursor 
Codex 
Hugging Face 
NVIDIA 
Visual Studio Code 
Devin 
Kiro 
Open Code 
NanoClaw 
Docker 
npm 
PyPy 
Wiz 
Financial Services 
Gaming 
Public Sector 
Automotive 
Technology 
Healthcare 
Build Continuously
Evidence for EU CRA
The EU Cyber Resilience Act gives you 24 hours to warn and 72 hours to notify from the moment you become aware of an actively exploited vulnerability. With JFrog, you already have the proof before the clock starts.
The Cost of Getting CRA Wrong
Face Fines Up to 2.5% of Turnover
The penalty applies to your entire company’s revenue, not just one product or team.
Lose the Right to Sell
Companies that cannot demonstrate compliance could lose the right to sell a product in the EU.
Pull Products Off the Market
Regulators can order a product recall. The logistics are immediate. The lost customers and deals are long-term damage.
Your Current Processes Leave Three Gaps CRA Will Expose
Your scans stop at build time. CRA does not.
CRA requires manufacturers to handle vulnerabilities effectively for the product’s full support period, generally at least five years. A build-time scan alone may not tell you about what is running in production six months later.
Your incident reports take days. CRA gives you hours.
CRA requires a 24-hour warning and 72-hour detailed notification to EU cybersecurity authorities the moment an active exploit vulnerability strikes, followed by a 14-day post-mitigation report. Assembling them by hand across disconnected tools increases the risk of errors and missed deadlines.
Your SBOM is a snapshot. CRA requires a living record.
CRA requires a machine-readable SBOM for your top-level dependencies, continually updated within your technical documentation. A one-time export breaks the first time your release velocity increases.
Govern CRA Requirements Across Your Software Supply Chain
Find the CRA obligation your team owns. See what JFrog supports and what evidence backs it.
SBOM and Vulnerability Disclosure
SBOM generation, technical documentation, and vulnerability disclosure across every release
Automated SBOMs And Disclosure Records
JFrog generates a standards-based SBOM for each scanned release, identifies and documents the components it detects, and alerts on vulnerabilities. It can keep your vulnerability disclosure policy and security contact attached to the product’s compliance record.
Vulnerability Handling & Remediation
Vulnerability handling, timely remediation, and security records across the full product lifecycle.
Continuous Monitoring And Release Gating
JFrog can continuously monitor the software components in your release for known vulnerabilities, rank and track them by exploitability, and maintain timestamped records of findings, waivers, and remediation decisions. Gate releases to help keep applicable critical vulnerabilities from shipping unless a policy or exception allows it.
Vulnerability & Incident Reporting
Evidence assembly for regulatory reporting once an actively exploited vulnerability or severe incident is known.
Ready-made Evidence For Reporting
JFrog can maintain the scan history and remediation records attached to each release, so when an incident is known, your team can access evidence that supports the 24-hour early warning, 72-hour notification, and final report without reconstructing it from scratch.
Secure Development Lifecycle
SDLC policy enforcement, providing a secure central repo of risk documentation, and technical file maintenance across the product lifecycle.
SDLC Policy Gates And Documentation
JFrog can enforce the SDLC policy gates you define at each development stage, store and version your risk assessments and technical documentation across the product lifecycle, and evaluate component approval before packages reach a build, reducing the attack surface at ingestion.
Third-Party & OSS Due Diligence
Due diligence on every third-party and open-source component before it enters a build.
Policy-based Component Screening
JFrog can evaluate third-party open-source packages against policy before they enter a build, and can track remediation of component vulnerabilities with the same detail used for first-party findings.
Conformity, Change Management & Audit
Conformity procedures, change records, technical documentation retention, and corrective-action records across every release.
Release-level Conformity & Change Evidence
JFrog enables you to bind verifiable change and conformity evidence to each release – verifying peer reviews, build provenance, and security gate results – while keeping corrective-action and vulnerability root-cause records directly linked to the release findings that triggered them.
Software Update & Support Lifecycle
Security support type, support period end date, and free-of-charge update policy attached to the product compliance record.
Support Metadata Per Release
JFrog can attach the security support type and free-of-charge security update policy to the product’s compliance record, so the disclosure requirement can be met as part of the standard release process.
From CRA Rule to Traceable Evidence in JFrog AppTrust
Enforce Pre-Mapped CRA Policies From Day One
Pre-mapped frameworks arrive as Policy-as-Code, so your team switches on the controls that apply instead of coding them. Each CRA control maps to one or more AppTrust rules, and coverage scoring shows how much of each framework is active.
Block Releases That Fail Your Policies Before They Ship
Out-of-the-box and customizable CRA policy gates can evaluate each promotion. When a control is set to block, releases that fail it don’t reach production, whether the issue is an unresolved CVE, a missing approval, or a failed test.
Pull Evidence for Any Release, When You Need It
AppTrust collects signed evidence from across your pipeline, including SBOMs, test results, Jira tickets, and provenance records, and binds it to one application version. No more assembling proof from screenshots or spreadsheets. Pull the evidence for that version when a regulator or customer asks.
Go Deeper on CRA Compliance
Frequently Asked Questions
The EU Cyber Resilience Act (Regulation (EU) 2024/2847) establishes mandatory cybersecurity requirements for products with digital elements sold on the EU market. The regulation entered into force on 10 December 2024, with Article 14 reporting mandates applying from 11 September 2026 and full enforcement taking effect on 11 December 2027.
It can. The CRA applies to in-scope products made available on the EU market, wherever the manufacturer is located.
JFrog AppTrust keeps scan results, sign-offs, and remediation history attached to each release, so your team starts the report from existing evidence rather than assembling it after the fact. Your team still drafts and submits it.
JFrog AppTrust can generate and maintain the compliance evidence (SBOMs, scan results, and policy sign-offs) that feed into your technical file. Narrative sections like the EU declaration of conformity, the cybersecurity risk assessment, and the product description still require authorship from your team.
No platform makes you compliant on its own. CRA obligations sit with the manufacturer. JFrog does not perform conformity assessments, issue CE markings, or set support periods. JFrog provides the software supply chain visibility, security intelligence, and evidence that support your compliance program.
The CRA can apply to any company that places products with digital elements on the EU market, regardless of company size or where you are headquartered. Key enforcement deadlines include Article 14 vulnerability and incident reporting (starting September 11, 2026) and full regulatory application, including secure-by-design and CE marking requirements (starting December 11, 2027).
The EU CRA requires a machine-readable SBOM covering at least top-level dependencies as part of technical documentation kept up to date. JFrog Xray can generate and export SPDX and CycloneDX SBOMs for scanned builds and releases to help track all components and dependencies.
Starting 11 December 2027, non-compliance with the EU CRA can lead to administrative fines of up to €15 million or 2.5% of total worldwide annual turnover, whichever is higher for breaches of the essential cybersecurity requirements and core manufacturer obligations. Market surveillance authorities can also require product withdrawals or recalls and restrict or prohibit sales.
