Is this legal advice?

No. PartsProof is a documentation and readiness service. We build your process artifacts from the regulation’s published text and ENISA guidance. For legal questions about your specific exposure, talk to counsel — our scope memo gives them a running start.

Does this make my product CE-compliant?

No, and be wary of anyone who says a document pack can. Full conformity (Annex I, CE marking) lands December 11, 2027 and involves real security engineering. This pack covers the September 11, 2026 reporting obligations completely, and the included gap checklist shows exactly what 2027 will ask of you.

I already sell in the EU. Does the deadline still apply to me?

Yes. Article 14 applies from September 11, 2026 to every in-scope product, including ones placed on the market before then, and the duty outlives the support period. It is not retroactive reporting, though: Commission guidance of July 27, 2026 confirms you owe nothing for exploitation you had already become aware of before that date. The clock runs on what you learn from September 11 onward.

What exactly do I have to report?

Two things: actively exploited vulnerabilities in your product, and severe incidents affecting its security. Each triggers the cascade — early warning in 24 hours, notification in 72, final report in 14 days (vulnerabilities) or a month (incidents) — filed once through the CRA Single Reporting Platform, addressed to the CSIRT where you have your main establishment. The runbook walks each step with the forms pre-drafted.

What’s an SBOM and why do I need one?

A software bill of materials — a machine-readable list of every component and dependency in your product. It’s how you answer “are we affected?” in minutes instead of days when a dependency CVE drops, and it’s expected under the CRA’s vulnerability-handling requirements.

My product is mostly open source. Am I exempt?

Only if it’s outside commercial activity. The moment you charge for the product, support, or hosting, you’re a manufacturer under the CRA. Open-source stewards get a lighter regime — the scope checker walks that edge case.

PartsProof vs FOSSA: an SCA platform or a CRA readiness pack

Both come up when a small maker searches for SBOM help. FOSSA scans code and generates an SBOM as one output of a broader license-and-vulnerability platform, billed monthly per project. PartsProof writes the disclosure policy, the SBOM and the 24-hour reporting runbook the CRA's reporting duties assume you already have, for a flat fee, once.

What each one actually is

FOSSA, read live on 4 September 2026, is a software composition analysis platform. Its Business tier is “$20 per project per month, billed annually”, for 10 projects with automated license and vulnerability scanning across the full dependency tree. An SBOM import is one line item among several; the platform is built to run continuously against a codebase, not to produce a one-time readiness pack for a reporting deadline.

PartsProof is a flat-fee pack: $79 for the Readiness Pack (a published disclosure policy, an SBOM for the product shipped, and the 24-hour incident reporting runbook with the deadlines written in), $149 for Readiness Plus, $299 for Readiness + Retainer. There is no scanning platform and no recurring seat. You publish and sign; PartsProof prepares.

What you compare on	PartsProof	FOSSA
Price	$79 / $149 / $299, one-time	$20/project/month, billed annually (Business)
What it is	A CRA reporting-readiness document pack	A continuous dependency-scanning platform
SBOM	Prepared once for the product described	Generated on every scan, across the dependency tree
Disclosure policy	Prepared as part of the pack	Not a stated feature
24-hour incident runbook	Prepared as part of the pack	Not a stated feature
Renewal	None. The pack is delivered and the files are yours	Monthly, per project, to keep scanning active

Which one is the right buy

A team already running continuous dependency scanning, or one that wants ongoing license and vulnerability coverage as code ships, gets real value from FOSSA at a published per-project price. It generates an SBOM as part of that, but the reporting clock the Cyber Resilience Act starts on 11 September 2026 also requires a disclosure channel and a runbook with the actual deadlines in it, neither of which a scanning platform states as a deliverable.

PartsProof is for the maker who needs those three specific documents done once, sized to the reporting duty rather than to a recurring seat count. Who can actually prepare this documentation goes through the roles in full.

PartsProof is not a dependency-scanning platform and does not run continuous scans. The FOSSA figures above are what its own pricing page stated on 4 September 2026 and are linked so they can be checked directly; they change without notice.