CRA reporting is live. Can you answer in 24 hours?
Since 11 September 2026, the EU Cyber Resilience Act expects an early warning within 24 hours of learning that a vulnerability in your product is being actively exploited. You cannot report what you cannot find. Omnitam turns the CycloneDX and SPDX SBOMs your pipeline already produces into one queryable, evidence-grade inventory, mapped to the estate that actually runs it.
⚡ Powered by the SBOM / Software Composition module · join the waitlist
Two deadlines. One prerequisite.
The Act phases in, but the capability it assumes, knowing what's inside every product you ship, does not phase in. It either exists when the question arrives, or it doesn't.
11 September 2026 · reporting is in force
Manufacturers must report actively exploited vulnerabilities and severe incidents in their products: an early warning within 24 hours of becoming aware, then a notification within 72 hours. The final report is due 14 days after a corrective or mitigating measure is available for an exploited vulnerability, and one month after the incident notification for a severe incident. Omnitam helps you find affected products and keep the evidence; it does not file reports for you.
11 December 2027 · full application
Products with digital elements placed on the EU market must meet the essential cybersecurity requirements, with technical documentation that includes a machine-readable SBOM covering at least the top-level dependencies, kept current.
Today · the visibility prerequisite
A 24-hour answer requires component-level visibility before the question arrives. Non-compliance risks fines of up to €15 million or 2.5% of worldwide turnover, whichever is higher. The organizations that will cope are the ones treating SBOMs as live inventory, not build artifacts in a folder.
What the Act asks. What the inventory answers.
Your build tooling generates the SBOMs. Omnitam is where they become answerable, versioned, reconciled against the discovered estate, and retained as evidence.
A machine-readable SBOM, kept current
Push SPDX and CycloneDX files straight from CI over the API, every build if you like. Each ingest is parsed, versioned, and reconciled, no source access, no build agent, nothing installed.
Components mapped to what runs
Composition sits beside agentless discovery of 84 AWS resource types in the same system of record, so a library resolves to the services and workloads running it, and the teams that own them.
The 24-hour question, as a search
"Where does component X ship and run?" returns services, versions, and the source SBOM that declared each one, in minutes. The affected-list half of an early warning stops being archaeology.
Technical documentation, on demand
Exportable reports and a tamper-evident audit trail behind every record, so what you tell an authority is backed by evidence of when you knew it and what it said.
Due diligence on third-party components
The declared license of every component, GPL, LGPL, MIT, Apache and the rest, recorded across everything the SBOMs declare. Automated obligation analysis is planned.
End-of-life operating systems, surfaced
Trace a component to the images and hosts it runs on and see which run an end-of-life OS, before an auditor, an acquirer, or an attacker finds them first. Flagging stale and unmaintained components is on the roadmap.
An advisory lands at 09:14. Then what?
Run the search, get the affected list with versions and owners, and export the evidence for your early warning, while the old playbook is still assembling a call.
| service | version | source SBOM | owner | exposure |
|---|---|---|---|---|
| photo-service | 1.2.4 | CycloneDX | platform-team | affected · upgrade ≥ 1.3.2 |
| pdf-render | 1.3.2 | SPDX | docs-team | clear |
| mobile-gateway | 1.2.4 | CycloneDX | apps-team | affected · upgrade ≥ 1.3.2 |
Where Omnitam fits. Honestly.
The record, not the generator
SBOMs are produced by your build tooling, any generator that emits CycloneDX or SPDX works. Omnitam is the system of record those files feed: versioned, queryable, reconciled against the running estate, and retained.
The where, not the scanner
Your security scanner tells you a component is vulnerable. Omnitam answers where it ships and runs, and keeps the evidence. Bring the advisory; leave with the affected list, versions, and owners.
The capability, not the compliance
No tool makes you CRA-compliant by itself. Omnitam covers the visibility and evidence layer the Act presumes; scope, conformity assessment, and legal obligations belong with your counsel.
This page is general information about the EU Cyber Resilience Act, not legal advice.
About the CRA and Omnitam.
Does the CRA even apply to us?
If you place hardware or software with digital elements on the EU market, manufacturer, importer, or distributor, it very likely does. The reporting obligations took effect on 11 September 2026; the full requirements, including the SBOM in your technical documentation, apply from 11 December 2027. Confirm your scope with counsel, then make sure the visibility exists either way.
Do you generate SBOMs, or need access to our source?
Neither. Omnitam ingests the SPDX and CycloneDX files your pipeline already produces, pushed over the API from CI. No source access, no build agent, consistent with the rest of the platform: read-only, nothing installed, you control what's shared.
We already run an SCA scanner. Why this?
Scanners look at repositories and builds. The CRA question is about products on the market and workloads in production: which ones contain the component, in which versions, owned by whom, provable to an authority. Omnitam maps declared components to the running estate and keeps the audit trail, the reporting answer, not just the finding. The two work best together.
How fast can we realistically be ready?
Connect AWS with a read-only role in under an hour, push your first SBOM from CI the same day, and run the drill above on your own estate when trials open (every trial includes every premium module). Join the waitlist to hear when trials open.
The next advisory won't wait for a spreadsheet.
Push one SBOM when trials open and time the drill yourself: component in, affected services out, evidence attached.