ActiveState

With the EU CRA, regulators require a governed OSS inventory, including current SBOMs and audit-ready remediation records. This will become ongoing sprint capacity and pull senior engineering time off roadmap work indefinitely. The call is yours: build that capability in-house or buy it. Either way, your organization's EU market access is what's at stake. The ActiveState Curated Catalog delivers built-from-source, remediated components across 12 language ecosystems on contractual SLAs, starting at 5 business days for Critical CVEs.

With the EU CRA, regulators require a governed OSS inventory that includes current SBOMs and audit-ready remediation records. This will become ongoing sprint capacity and pull senior engineering time off roadmap work indefinitely. The call is yours: build that capability in-house or buy it. Either way, your organization's EU market access is what's at stake. The ActiveState Curated Catalog delivers built-from-source, remediated components across 12 language ecosystems on contractual SLAs, starting at 5 business days for Critical CVEs.

Four technical deliverables the EU CRA expects from your build path: 1. A machine-readable SBOM, kept current as the dependency graph changes. 2. A documented vulnerability handling workflow, with trigger criteria set in advance to support the 24-hour early warning window. 3. Verified integrity for every open source component shipped inside the product, demonstrated through cryptographic provenance. 4. Committed support periods and defined remediation SLAs for the product's expected lifetime. These sit outside what scanners detect, and all four are what an authority can hold your build path to under the EU CRA. See what each one means for your build path.

You’ve got SBOMs and scanners, but will they stand up to EU CRA Article 14 scrutiny? This 5-question assessment benchmarks your current approach, identifies gaps in incident reporting, and helps you understand how a cryptographically attested open source inventory plus predictable remediation workflows can protect your EU market access.

You’re on the hook for strict EU CRA incident reporting timelines. Get the help to map those requirements to your existing systems of record, from SBOM managers, SIEM, change management, and SLA tracking, so you know exactly what to log, how fast to respond, and what evidence to keep on hand when regulators come calling.

Security teams own the EU CRA deadline, but Engineering leaders own everything the deadline depends on. 96% of applications include open source components, and from September 11th, the EU CRA requires reporting on actively exploited vulnerabilities. That depends on your team already knowing what's in the build. That work lands on your roadmap, and your organization's EU market access is a part of what's at stake. See what that actually costs in sprint capacity.