ECZ-ID SBOM & CRA Readiness

CRA reporting obligations apply from 11 September 2026. Could you identify an affected component and its evidence chain within 24 hours?

Free, local-first evidence review. No source upload. No sign-in to run a check.

Could your team identify an affected software component and its evidence chain within the reporting window? Under Regulation (EU) 2024/2847 (the Cyber Resilience Act), Article 14 applies from 11 September 2026: a manufacturer that becomes aware of an actively exploited vulnerability or a severe incident must send an early warning within 24 hours, a fuller notification within 72 hours, and a final report (no later than 14 days after a fix is available for a vulnerability; within one month for a severe incident). The Regulation as a whole applies from 11 December 2027.

Answering inside that window starts with knowing what is in the release. This extension answers one operational question in under a minute: what SBOM, disclosure and vulnerability evidence can I see in this workspace, what is not observed, and what deserves review next?

• Surfaces the machine-readable SBOM first (CycloneDX or SPDX), then format posture, dependency lockfiles, VEX / CSAF statements, the vulnerability disclosure policy and security contact, build provenance and attestations, and the release record. Locally, by filename and path.
• Gives every result a deterministic Review Priority (LOW / NORMAL / ELEVATED / HIGH) with the exact reasons. Never a score.
• Explains, for each evidence class, what was observed, what was not, why it matters under the CRA (with the provision), and what to review next.
• Shows at most three next actions matched to the result: free ECZ-ID tools and guidance first, TrustOps routes only where a resolver-verifiable result would help.

What you can do in under a minute

1. Open a project, trust the workspace, and run ECZ-ID SBOM & CRA Readiness: Review / Scan Workspace.
2. Read the evidence review: Review Priority, observed / not observed, why it matters, review next.
3. Run ECZ-ID SBOM & CRA Readiness: Build Evidence Summary for a shareable, claim-free summary, or ECZ-ID SBOM & CRA Readiness: Generate local evidence report for JSON and Markdown you can keep beside the repository.

Example result

ECZ-ID SBOM & CRA Readiness: Evidence Review
Could your team identify an affected software component and its evidence chain within the reporting window?

Review Priority: ELEVATED
Why: one primary evidence class was not observed.

Machine-readable SBOM (CycloneDX or SPDX) ... OBSERVED, REVIEW REQUIRED  sbom/bom.json
CycloneDX SBOM ............................. OBSERVED                   sbom/bom.json
SPDX SBOM .................................. NOT OBSERVED
Dependency lockfile ........................ OBSERVED                   package-lock.json
VEX / CSAF vulnerability statements ........ NOT OBSERVED
Vulnerability disclosure policy / contact .. OBSERVED, REVIEW REQUIRED  SECURITY.md
Build provenance / attestations ............ NOT OBSERVED
Release record ............................. OBSERVED                   CHANGELOG.md

Review next: start a VEX or CSAF document for the current release; confirm the SBOM
names the release it describes and was generated from the lockfile.
Next actions: SBOM & CRA guidance; Cyber Resilience Passport (TrustOps);
Software Supply Chain Passport (TrustOps).

What it looks for

What results mean

Results use four states and a priority, never a verdict:

EVIDENCE OBSERVED, EVIDENCE NOT OBSERVED, REVIEW RECOMMENDED, REVIEW REQUIRED, plus Review Priority LOW / NORMAL / ELEVATED / HIGH.

Filename and path detection shows that a document exists where you expect it. It does not read the document, does not parse the SBOM and cannot judge its completeness; observed SBOM, VEX, disclosure and provenance items are marked for human review. Review Priority is not a safety, approval or compliance determination. Missing evidence is neutral. Your local policy decides what is sufficient, and you should re-check before reliance.

Useful for

• Manufacturers and software vendors placing products with digital elements on the EU market, and the teams who will have to answer inside the reporting window
• Product security and PSIRT leads who own vulnerability disclosure and coordinated response
• Open-source maintainers whose components ship inside commercial products and who are asked for SBOM and VEX evidence
• Platform, DevOps and release engineers who own the pipeline the SBOM and attestations come from

Relevant when a customer or platform asks for the SBOM for a release, a vulnerability is announced in a component you may ship, you are preparing your Article 14 reporting process, or an auditor asks how a component and its fix would be traced.

Example use cases

• A widely used library announces an actively exploited vulnerability. Run the review to see whether the SBOM, lockfile and VEX evidence exist to say within hours whether you ship the affected version.
• Before a release, confirm the CycloneDX or SPDX document, the changelog entry and the disclosure policy are where a buyer or auditor will look.
• A platform onboarding questionnaire asks for your vulnerability disclosure contact and SBOM practice. Check that SECURITY.md and a machine-readable SBOM are present and current.

Go further, only where relevant

Each review shows at most three next actions chosen from what it observed:

• Free ECZ-ID Dependency Security and CI/CD Trust reviews of the lockfile, dependency and pipeline provenance evidence behind the SBOM: https://open-vsx.org/extension/ecocitizenz/eczid-dependency-security and https://open-vsx.org/extension/ecocitizenz/eczid-cicd-trust
• SBOM & CRA guidance on the ECZ-ID Developer Gateway: https://developers.ecocitizenz.com/sbom/
• Software Supply Chain Passport, Cyber Resilience Passport and SBOM vendor credentialing in TrustOps, when the evidence exists and you want a resolver-verifiable result a buyer, auditor or platform can check without exchanging documents: https://trustops.ecocitizenz.com/start?flow=api-software , https://trustops.ecocitizenz.com/start?flow=critical-cyber-resilience and https://trustops.ecocitizenz.com/start?flow=dora-sbom
• Verified ECZ-ID (£19.99/month) or Assured ECZ-ID (£49.99/month): the public identity every ECZ-ID credential attaches to. Counterparties check it in Resolver: https://trustops.ecocitizenz.com/start#parent-tiers

View all relevant SBOM / CRA products: https://developers.ecocitizenz.com/dora-sbom-suite/

TrustOps handles setup and checkout. This extension runs no payment, issues no ECZ-ID and creates no Resolver proof. Prices shown were read from the TrustOps catalogue on 2026-09-03; TrustOps shows the current price before any payment.

Privacy and permissions

The privacy notice ships inside the extension: run ECZ-ID SBOM & CRA Readiness: Open Privacy Notice (bundled).

Frequently asked questions

Is this extension free? Yes. Every local review is free, with no sign-in and no purchase.

Does it upload my SBOM or source code? No. Detection is filename and path only. No source, prompts, secrets or tool payloads leave your device, and there is no telemetry.

Does a missing item mean something is wrong? No. "Evidence not observed" is neutral. It tells you where a reviewer, or your own team inside the reporting window, will find a gap in this workspace; your local policy decides what is sufficient.

Does everything in the CRA apply from 11 September 2026? No. Article 14 (reporting obligations for manufacturers) applies from 11 September 2026; the Regulation as a whole applies from 11 December 2027. Both dates are in the text of Article 71.

What happens when the public interface service is unavailable? It keeps working from a bundled contract. A refresh is optional and user-initiated.

What it does not do

• No source, prompt or secret upload, and no telemetry.
• Local evidence review and routing only. It does not parse or validate an SBOM, issue ECZ-ID proof, activate services, grant access, or make approval, safety, insurance or compliance decisions.
• Makes no safety, approval, certification or compliance claim about you or your product, and does not determine whether you are a manufacturer in scope.
• Runs no checkout or payment. Commercial actions happen only in TrustOps.

Install and first use

1. In your editor's Extensions view, search for ECZ-ID SBOM & CRA Readiness (publisher EcoCitizenz) and install it.
2. Open a project and trust the workspace.
3. Run ECZ-ID SBOM & CRA Readiness: Review / Scan Workspace and read the evidence review.

Python / CLI

Prefer Python, CI or terminal automation?

python -m pip install ecz-id-sbom
ecz-id-sbom --help

• Matching Python package: https://pypi.org/project/ecz-id-sbom/
• All ECZ-ID Python tools: https://developers.ecocitizenz.com/python

The Python tools run locally and inspect, explain and route only, the same role boundary as this extension.

Machine-readable facts

Links and support

• Product page and guidance: https://developers.ecocitizenz.com/sbom/
• This listing on both registries: https://marketplace.visualstudio.com/items?itemName=ecocitizenz.eczid-sbom-readiness and https://open-vsx.org/extension/ecocitizenz/eczid-sbom-readiness
• Resolver (read-only proof): https://resolver.ecocitizenz.org
• TrustOps (supported setup): https://trustops.ecocitizenz.com/start
• Questions: the Q&A tab of this listing, or https://developers.ecocitizenz.com/faq/
• Privacy: the bundled PRIVACY.md

ECZ-ID is independent trust infrastructure. Third-party names describe compatible ecosystems only and do not imply endorsement or affiliation. Local policy decides whether the evidence you review is sufficient.