What euvex provides, part by part
For each part: what it is, why it matters, what euvex does, and what euvex does not do. Every deadline quoted here comes from the regulatory text, not from a blog post.
input formats
6
npm, pnpm, yarn, CycloneDX, SPDX 2 and 3
regulations covered
3
CRA, RED, Machinery
of retention
10 years
the legal floor, unlimited by default
From lockfile to declaration · hover over a steptap a step
CRA · 11.12.2027
The SBOM
npm, pnpm and yarn lockfiles read directly, an existing CycloneDX or SPDX SBOM imported as it is; deterministic CycloneDX 1.5 export.
Read this partThe scan
Matched against OSV at every upload; the daily pass adds the NVD, queried by CPE.
Read this partMonitoring
Rechecked every day; an email only on a new CVE, from the severity you choose.
Read this partHistory and archive
Timestamped append-only log, never rewritten; the complete archive as one self-contained file.
Read this partRED
Structured questionnaire of the requirements, printable report, the CVE verdict of the linked scan reused.
Read this partMachinery
The declarative mechanism of RED over the cyber scope of the act, printable report.
Read this partThe EU declaration
Assembled from your parts (CRA, RED, Machinery). euvex assembles, you sign.
Read this partThe SBOM: the inventory of your software
CRA, Annex I Part II · applicable from 11.12.2027
What it is.
The complete list of a product's software components (names, exact versions, integrity hashes, and licences when the lockfile carries them: npm does, pnpm and yarn do not) in the standard CycloneDX 1.5 format, readable by machines: scanning tools, auditors, acquirers.
Why it matters.
The Cyber Resilience Act makes it an essential requirement for selling a digital product in the EU. And without an inventory, there is no answering the only question that matters on the day of a flaw: am I affected? That was the log4j episode: the panic came from nobody knowing where the library was hiding.
What euvex does.
Six input formats: npm, pnpm and yarn lockfiles are read directly, and a CycloneDX or SPDX (2.2, 2.3 or 3.0) SBOM produced by another chain imports as it is. The export is deterministic: the same inventory always produces the same file, which makes comparisons and archiving reliable. The lockfile is read, then discarded, never kept.
Illustration · from lockfile to SBOM
The scan: which flaws affect you
Known CVEs · OSV and NVD
What it is.
The components of the inventory are matched against public vulnerability advisories: which CVEs affect which dependencies, at what severity.
Why it matters.
It is the first thing an auditor or an acquirer does with your SBOM. Better to have done it before them.
What euvex does.
The scan runs at every upload, free of charge, and the verdict is detailed component by component. It queries OSV, then the daily pass adds a second source for what OSV cannot resolve: the NVD, queried by CPE. A CPE declared in the SBOM is used as it is; failing that, the name and the exact version. That is exactly the case of components in pkg:generic, which Yocto, Buildroot and conan produce by default.
Illustration · 96 components of a firmware
euvex refuses to conclude: 3 component(s) not analysed
What euvex does not do
Monitoring: because the CVE lands after your release
CRA, Art. 31 · “continuously updated”
What it is.
Every scan is rechecked every day, automatically. An SBOM is true on the day it is generated; the vulnerability that concerns you will be published on another day.
Why it matters.
The technical documentation must be continuously updated, where appropriate, at least during the support period (Art. 31): a file that was accurate on placing on the market and never touched again is a file in breach, even if nobody notices.
What euvex does.
An email goes out only when a new CVE hits one of your dependencies: no weekly report to sort through, no noise. You choose from which severity: all, high and above, or critical only. This setting filters emails, never detection: a vulnerability found is recorded and visible in the console whatever happens, and an unrated severity passes every threshold, because it is not a low severity. Unsubscribe in one click. The address is optional and is used for that only.
Example · email alert threshold
| New vulnerability | Detected | |
|---|---|---|
| criticalminimistCVE-2021-44906 | yes | sent |
| highlodashCVE-2021-23337 | yes | sent |
| mediumsemverCVE-2022-25883 | yes | sent |
| unratedpaquet-interneno score | yes | sent · passes every threshold |
This setting filters emails, never detection.
4 vulnerabilities detected, 4 emails sent.
Reporting: Art. 14, on the clock
CRA, Art. 14 · applicable from 11 September 2026
What it is.
The obligation to notify the CSIRT designated as coordinator and ENISA of any actively exploited vulnerability contained in your product, and of any severe incident.
Why it matters.
The deadlines are short and stack up: an early warning within 24 hours, a notification within 72 hours, then a final report: 14 days after a corrective or mitigating measure is available for a vulnerability, one month after the notification for an incident. These clocks are always discovered at the worst moment.
What euvex does.
Your components are matched against the CISA KEV catalogue: the criterion in the text is “actively exploited”, not “severe”, and that catalogue is what lists it. euvex opens the case, counts down each deadline, prepares the content of the notification, and cites the scan revision that produced the date of awareness, so that it can be cross-checked, not merely asserted.
Early warning: deadline passed. Notification: still within the deadline.
What euvex does not do
CRA, Art. 13(13) · at least ten years
History and archive: proving what you knew, and when
What it is. Every check is timestamped and kept: an append-only log, never rewritten.
Why it matters. The technical documentation and the declaration of conformity must stay at the disposal of the market surveillance authorities for at least ten years after placing on the market, or for the whole support period if it is longer. And Art. 14 runs its first two deadlines from the moment of becoming aware: you must be able to say when you knew.
What euvex does. The history names its gaps: “nothing changed” and “nobody was looking” are never confused. Retention is unlimited by default: no duration below the legal floor is even offered. And the complete archive downloads as one self-contained file, each revision in standard CycloneDX, dated at capture: your evidence does not depend on euvex surviving.
RED, Delegated Regulation 2022/30 · applicable from 01.08.2025
RED: radio equipment, already in scope
What it is. The cybersecurity requirements of the Radio Equipment Directive, for radio equipment connected to the internet, equipment that processes personal data and equipment that transfers money. Applicable from 01.08.2025, it is the oldest of the obligations on this page.
Why it matters. The pain is present, not future. And the RED file moves over to the CRA in December 2027: same product, same customer, same file to keep alive.
What euvex does. A structured questionnaire of the requirements a manufacturer can actually declare, a printable report, and the reuse of the CVE verdict of the linked scan, with no double entry.
The exact scope, the EN 18031 standards and their restrictions, read in the Official Journal.
Does not · euvex does not test your device. The technical requirements (EN 18031) concern the equipment's behaviour: secure updates, authentication, network traffic. euvex structures your declaration; it does not measure it.
Machinery Regulation 2023/1230 · applicable from 20.01.2027
Machinery: cyber becomes a safety requirement
What it is. The new Machinery Regulation makes cybersecurity an essential health and safety requirement (Annex III, points 1.1.9 and 1.2.1): a machine that can be corrupted is a dangerous machine.
Why it matters. It is the next deadline for machinery manufacturers: until 20.01.2027, Directive 2006/42/EC applies. And the text asks for a software inventory without naming it: the machine identifies the software installed on it that it needs to operate safely, and shall be “able to provide that information at all times in an easily accessible form” (1.1.9, fourth paragraph). Point 1.2.1(f) adds a tracing log of interventions and of the versions of safety software uploaded after placing on the market, enabled for five years after such upload.
What euvex does. The same declarative mechanism as RED (a part per product, a printable report) over the cyber scope of the act. One requirement is measured instead of declared: the inventory of the fourth paragraph of 1.1.9 is read from the software scan linked to the product.
The scope, the cyber passages of Annex III and the timeline, read in the Official Journal.
Does not · euvex does not check the protection against corruption, the machine's logs or the functional safety of its controls: these are behaviours, declared and proven by tests. The expected harmonised standard, prEN 50742, is still a draft: the references in this part are euvex identifiers, not clause numbers.
Machinery Regulation, Annex V
The single EU declaration: one file, not five
What it is. The final piece of the CE marking: the declaration of conformity, which lists all the Union harmonisation legislation applicable to the product. The law provides for a single document, not one declaration per regulation.
Why it matters. It is what manufacturers assemble by hand today, act by act. Consolidation is not a convenience euvex invents: it is already in the law.
What euvex does. It assembles the declaration from your parts (CRA, RED, Machinery) with the reference of each act.
The technical documentation and the declaration, explained, for whoever signs them.
Does not · euvex does not sign it. The declaration is “issued under the sole responsibility of the manufacturer” (Annex V, point 4): euvex assembles, you sign.
Printed to PDF
The printable files: the artefact you hand to the auditor
What it is. Each part produces a printable, self-contained document: the scan file (SBOM, vulnerabilities, dated history), the CRA report (what euvex measures, then what you declare), the RED report, the Machinery report, the Art. 14 reporting file.
Why it matters. An inspection, a customer review or an audit works on documents. A screen cannot be handed over; a document can.
Frequently asked questions
Before you start
- Do I need a notified body?
It depends on the act, on the product's category and on the standards you apply. euvex is not a notified body and does not replace its involvement when it is required. Under RED, some restrictions in the EN 18031 standards remove the presumption of conformity: which ones.
- Does euvex give legal advice?
No. euvex structures, dates and assembles your file; it does not classify your product for you, and it signs nothing. The key dates publish each deadline with its source in the Official Journal, so that you can check it yourself.
- What happens to my data if euvex disappears?
What you have downloaded no longer depends on us. Each scan's archive contains all its revisions in standard CycloneDX, dated at capture. The account export, in your settings, gathers your products, your CRA, RED and Machinery questionnaires, your Art. 14 cases and your alerts in one JSON file. Both can be downloaded at any time, without asking. Keep a copy with your technical documentation, which must remain available for at least ten years.
- My SBOM comes from a firmware build chain, Yocto for example. Is it read?
Yes, if it is in CycloneDX JSON (versions 1.2 to 1.6) or in SPDX (2.2 and 2.3 in JSON or tag-value, 3.0 in JSON-LD): it imports as it is. The SPDX of Yocto 5.1 and later can be uploaded directly; the .spdx.tar.zst archive of Yocto 5.0 cannot. Components in
pkg:generic, which these chains often produce, are looked up in the NVD by CPE; those that offer neither a CPE nor an exact version stay “not analysed”, never counted as clean.
All the questions, including what euvex does not do.
Where to start
Everything is free during the beta and requires an account, including the scan. The account is what lets us alert you when a new flaw hits one of your products. See a complete file, on a fictional product (in French), or prepare the first one with us.