Cyber Resilience Act evidence with Preloop
Machine evidence for products with digital elements
The instrument is Regulation (EU) 2024/2847 (Cyber Resilience Act, CRA).
- Vulnerability and incident reporting duties: CRA Art. 14, apply from 11 September 2026.
- Full CRA obligations, including conformity assessment and CE marking for in-scope products: 11 December 2027.
Preloop ships Apache flow presets that verify an SBOM your build already produced, map components to public vulnerability sources, and write a versioned result.json plus an evidence directory. Teams use that as machine evidence for a human assessor.
Preloop does not generate an SBOM. It does not perform a conformity assessment. It does not file CRA Art. 14 reports. It does not decide CE marking.
Not legal advice
Preloop is not a law firm. Nothing on this site is legal advice. Every regulation reference names the instrument and the article or date so you can check it against EUR-Lex yourself.
Where the CRA talks about components and reporting
The following is what the text says, not a claim that Preloop satisfies it.
- Due diligence on integrated components (CRA Art. 13). Manufacturers must exercise due diligence on components they integrate, including third-party and open-source parts. Preloop's component due-diligence preset records agent research and a human risk decision via an approval. The human carries the risk decision. The record is not a Declaration of Conformity.
- Reporting of actively exploited vulnerabilities (CRA Art. 14). Reporting duties apply from 11 September 2026. The exploit-check preset can flag CISA KEV hits as a prioritisation signal for a person. Preloop does not file the report.
- SBOM / technical documentation. The CRA expects manufacturers to be able to produce software bill of materials information as part of product documentation. Preloop verifies SPDX or CycloneDX files your toolchain emitted (format, NTIA/CRA minimum elements, completeness against manifests you provide). It never invents an SBOM.
What the presets actually write
| Preset | Schema | What a run produces |
|---|---|---|
| SBOM Verify | preloop.cra.sbomaudit/v1 |
Format and completeness checks vs the SBOM and manifests you delivered |
| SBOM Exploit Check | preloop.cra.vulnscan/v1 |
Components mapped to OSV.dev / CISA KEV, with honest unmatchable counts |
| Release Security Audit | preloop.cra.releaseaudit/v1 |
Both of the above, plus drift vs a previous result.json |
| Component due diligence | preloop.cra.duediligence/v1 |
One component dossier; a human accepts or rejects via approval |
Every artifact is supposed to carry the line: machine-generated evidence for conformity assessment support. Not a conformity assessment, certification, or legal advice.
Wire a CI job to a flow webhook, poll GET /api/v1/flows/executions/{id}/result, and keep the evidence tarball from GET /api/v1/flows/executions/{id}/evidence. The runbook lives with the Apache presets: security audit presets.
What Preloop session logs add
Separately from the presets, the control plane records governed tool calls, policy decisions, approvals, and model spend on a runtime session timeline. That is useful operational evidence. It is not manufacturer due diligence by itself, and it is not CE marking.