CRA compliance will be judged by the binary you ship

This article argues that CRA compliance must be grounded in artifact-level (binary) evidence rather than paperwork or SBOMs, and illustrates the point with an anonymized assessment of a network appliance that verified 12,263 components, mapped 1,430 CVEs (597 with public exploit code, nine in CISA KEV), found 1,976 binaries without ASLR, shipped cleartext private keys and certificates, used cleartext FTP for updates, and ran an EOL OS — concluding the release could not credibly support a conformity declaration and recommending structured evidence reports to track and remediate gaps.