Skip to main content
Chapter three of the gateway build. The gateway works. In Europe, working is no longer the bar.
The EU Cyber Resilience Act asks for evidence that software is secure. The first obligations apply from 11 September 2026 and the essential requirements bind from 11 December 2027. We ran the check in the same session as the build, with no separate tools.

​
What we ran

An SBOM, a CVE scan and a posture check on the build we had just flashed. It found real gaps. We fixed the top one and reran it clean, with the scanner, the dashboard and the MQTT uplink still working.
A readiness aid, not a conformity assessment. It never asserts the firmware is compliant. See CRA readiness for what the check is and is not.
CRA readiness is a firmware problem before it is a paperwork one. Run the same check on your own build.

What the check is

The capability in full, and how to run it on your own project.

Build from scratch

Back to the start: one written spec to firmware on two chips.
Run on the firmware from chapters one and two, on a Fanstel BWG840xReport 11 August 2026Databases OSV, EU EUVD and NVD, as of the scan dateArtifacts the readiness report, its JSON companion, and an SPDX SBOM for each chip