Skip to main content
The EU Cyber Resilience Act sets security obligations for any product with software in it. The first of them, reporting actively exploited vulnerabilities, applies from 11 September 2026. The essential requirements bind from 11 December 2027. Adsum turns the readiness work into one click on your real build.
A readiness aid, not a conformity assessment and not legal advice. It reports your build’s evidence and what to verify. Only a notified body or your own formal assessment establishes conformity, and the agent can be wrong: the conclusions are yours to check.
The whole check, on a real gateway build, in the session that built it: SBOM, scan, posture, then the top finding fixed and re-verified on the hardware.
From the gateway build, CRA-checked in chapter three.

​
What one click gives you

Your real buildThe binary you flashed, not a guess from the source tree.
An SBOM, in SPDXEvery library actually in it, with a usable identifier where the toolchain gives one.
Known CVEs, rankedMatched against published advisories, ordered by what applies to this build.
Your postureSecure-by-design checks read from your real configuration, not a questionnaire.
One dated reportWritten into your repository, top finding first, with what to verify.
Then round again. Close the top gap, rebuild, and the evidence regenerates from what you actually shipped. The report is a loop, not a document.

It gathers evidence and says what to verify. It never asserts conformity.

Starting from a vendor advisory instead? It confirms the component is really in your build, then helps you rebuild. It names the CRA date that applies to you and writes everything to a compliance/ folder.

​
Run it

1

Open your project, or none at all

Your own nRF or ESP firmware, or a bundled sample with nothing open.
2

Pick CRA SBOM & Fix

From the home’s workflow cards. The agent builds the SBOM, reads your real configuration, and drafts the report.
3

Read it, then close the top gap

Open compliance/CRA_READINESS.md, ranked top to bottom. Wire the fix, rebuild, re-verify, in the same loop.
The scan matches published CVEs, dated. It finds no zero-days, and a component it cannot query is reported as unqueried, never as clean. See limitations for the full list.