- Also gone: "Every component deposited, current, and verified" (an absolute), the old Certified-tier seal, "Versions kept: 12" and "you set how many to retain" (retention of earlier versions isn't confirmed), "Supplier documentation sourcing" (Codekeeper approaching your suppliers isn't a confirmed service), the €15M and €5M fines (Article 64, not verified), "AES256/512" and "live in 24 hours".
- Angle: the deposit holds the components with your code, and a rebuild in the Codekeeper AI Verification Lab shows whether the product builds from what's there. Missing items are flagged. That's the confirmed proof.
- Hero visual: a run report for the same example product as the other CRA pages, with one licensed SDK requested and added during the run (the pattern the home and Agentic Verification pages use). Example values only.
- Confirm before launch: whether a rebuild can fetch public packages from an internal mirror. The Verification Lab is cut off from the open internet (confirmed), so the page says the rebuild "works from the deposit". If product says it can use a mirror, soften that line.
Third-party code, kept with yours. Proof it still builds.
The CRA makes the components inside your product part of your duty: due diligence when you integrate them, and vulnerability handling for the whole support period. Codekeeper holds them in the deposit with your code and, with Agentic Verification, proves the product rebuilds from it.
Escrow from $199. Escrow Pro from $449. Per application per month.
- Trusted by 3,500+ teams
- ISO/IEC 27001:2022 certified
- Missing components flagged on every rebuild
Trusted by 3,500+ teams, from regulated enterprises to fast-growing software vendors
- Production errors not repeated: "Article 3(1) makes your supplier a manufacturer too". Article 3, point (1) defines a product with digital elements, which includes components placed on the market separately; it isn't a manufacturer rule. "Article 64(10)(b) exempts open-source software stewards from administrative fines": Article 64 could not be read, and an English corrigendum of 2 July 2025 changed the opening of Article 64(10), so production's paraphrase needs a legal check either way. The EU AI Act, NIS2, DORA, ISO 27001 and SOC 2 mappings are left out: they aren't verified, and this page is about the CRA.
What the CRA asks
Code you didn't write is still in your care.
Open-source libraries, licensed SDKs and private packages from other teams all count. The CRA asks for due diligence when you integrate them, and for their vulnerabilities to be handled for as long as you support the product.
“For the purpose of complying with paragraph 1, manufacturers shall exercise due diligence when integrating components sourced from third parties so that those components do not compromise the cybersecurity of the product with digital elements, including when integrating components of free and open-source software that have not been made available on the market in the course of a commercial activity.”
“Manufacturers shall, upon identifying a vulnerability in a component, including in an open source-component, which is integrated in the product with digital elements report the vulnerability to the person or entity manufacturing or maintaining the component, and address and remediate the vulnerability in accordance with the vulnerability handling requirements set out in Part II of Annex I.”
“Manufacturers shall ensure, when placing a product with digital elements on the market, and for the support period, that vulnerabilities of that product, including its components, are handled effectively and in accordance with the essential cybersecurity requirements set out in Part II of Annex I.”
“When determining the support period, manufacturers may also take into account … the support periods of integrated components that provide core functions and are sourced from third parties …”
Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide.
In practice
A fix has to build against what you shipped.
Your build pulls components from places you don't control. Years into a support period, the release you shipped has to build again, with the patched component in it.
Packages move
A version can be withdrawn from a public registry, and a project can stop being maintained. Your product still depends on the version it shipped with.
Suppliers change
A licensed SDK's vendor can be acquired, change its terms or stop trading. A vulnerability in its component is still yours to address and remediate.
Builds drift
Build servers pull the newest compatible versions. Rebuilding an older release can need versions nobody kept on purpose.
- Confirm with sales before launch: the last row. It offers Escrow with the manufacturer as beneficiary, for a licensed component it buys. That follows the confirmed model (Escrow is for supplier applications, with a depositor and a beneficiary), but check that a component or SDK is accepted as an application.
- "Synced daily" is a production claim, still flagged in to-confirm.md.
- 16 Oct: Continuity Pro added; base Continuity no longer includes Agentic Verification, so the SBOM and rebuild rows name Continuity Pro.
Evidence map
What Codekeeper holds, and what it proves.
The components travel with your code. A rebuild shows whether the product builds from the deposit alone.
| CRA | Codekeeper evidence |
|---|---|
| Art. 13(5) Due diligence when integrating components | An inventory of what the product is built from, produced by an independent rebuild, for your assessment to start from. SBOMEscrow Pro · Resilience Pro · Continuity Pro |
| Art. 13(6) Remediate a vulnerability in a component | To ship the fix, the product has to build with the patched component. Each rebuild works from the deposit in the Codekeeper AI Verification Lab, with no help from your team, and flags anything missing. Recoverability CertificateRun reportBuild stepsEscrow Pro · Resilience Pro · Continuity Pro |
| Art. 13(8) Components kept within reach for the support period | Open-source, licensed and private components deposited with your code and synced daily, with an automated check of what's there. Vault reportSoftware Resilience CertificateEvery protection |
| Art. 13(6) and 13(8) A licensed component's vendor stops | For a component you buy, the vendor can deposit it under an Escrow Agreement with you as the beneficiary, released to you if an agreed condition is met. Escrow AgreementSoftware Resilience CertificateEscrow · Escrow Pro |
Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide.
Choose the level
Held and checked, or proven to build.
Both hold your code and its components with a neutral party. Escrow Pro adds the rebuild that shows the product builds from them.
Escrow
From$199per application per month
Everything you need to be protected.
- Your code and its components held by a neutral party
- Automated check of what's deposited, with a vault report
- Software Resilience Certificate
- Release to your customers under the Escrow Agreement
Escrow Pro
From$449per application per month
Everything you need to recover.
- Everything in Escrow
- Agentic Verification: 4 rebuilds a year in the Codekeeper AI Verification Lab, on supported technology stacks
- Missing components flagged on every run
- Build steps, SBOM, Exit workbook and a deployable copy
- Recoverability Certificate
Prices for software applications; SaaS and AI have their own rows. Setup $499 per arrangement. Escrow means the deposit is released to you and you run the recovery. Resilience costs more because we do the recovery. Continuity costs more again because we also keep the live environment switched on. At every protection, Pro adds Agentic Verification. Rather we ran the recovery for your customers? That's Resilience. See full pricing
Sample evidence pack
See what your auditor would receive.
An anonymised set of outputs from a real Agentic Verification run, so you can judge the evidence before you talk to us.
- Recoverability Certificate
- Run report
- SBOM and Exit workbook excerpts
- No visible answer on keeping older component versions. Retention of earlier deposit versions isn't confirmed (to-confirm.md). Add an answer once product confirms it.
Questions
Before you plan for your components.
What counts as a component under the CRA?
Article 3, point (6): “‘component’ means software or hardware intended for integration into an electronic information system”. In practice that covers open-source libraries, licensed SDKs, embedded operating systems and private packages from other teams.
Does the duty cover open-source components?
Yes. Article 13(5) includes “components of free and open-source software that have not been made available on the market in the course of a commercial activity”, and Article 13(6) covers a vulnerability found “in an open source-component”.
Is there a time limit on the component duty?
Due diligence under Article 13(5) applies when you integrate a component. Article 13(8) then asks you to handle vulnerabilities in the product, “including its components”, for the support period. That period is at least five years, unless the product is expected to be in use for less. See covering the support period.
Will Codekeeper assess our components?
No. A rebuild shows whether the product builds from the deposit, and the SBOM lists what it was built from. Whether a component is secure enough to integrate is for your due diligence and your assessor.
How is a deposit different from our own registry mirror?
A deposit is held by a neutral party, outside your own systems. A rebuild in the Codekeeper AI Verification Lab, with no help from your team, then shows the product builds from it. A mirror sits inside the infrastructure it's meant to protect.
Can we protect a licensed component we buy?
Yes. If a vendor supplies a component your product depends on, the vendor can deposit it under an Escrow Agreement with you as the beneficiary, released to you if an agreed condition is met. Bring the details to a demo and we'll look at how it fits.
When does this apply?
The CRA entered into force on 10 December 2024. Reporting obligations apply from 11 September 2026, and the main obligations from 11 December 2027.
Is our code safe with you?
Codekeeper is ISO/IEC 27001:2022 certified. Deposits are encrypted at rest, and rebuilds run on our own models in the Codekeeper AI Verification Lab, so code stays in our environment. See the Trust Center.
Keep your components within reach.
We'll take one product and look at what it's built from, what the deposit holds, and what a rebuild shows.