CRA Product Conformance (EU CRA Annex I + Art. 14)

Note (dated 2026-08-04): a chain composes independent computations performed in an analytical order. No step's output is carried into the next step by the execution model; each step computes from its own declared inputs. This is true of every chain on this site, including chains whose per-step copy below reads as a data handoff.

Validate an SPDX SBOM against the EU CRA Annex I machine-readable SBOM requirement (art-138) → check Annex I essential requirements: SBOM machine-readable, top-level dep coverage, vulnerability handling policy, secure-by-default, and conformity route (art-139) → assess CRA Article 14 vulnerability reporting readiness: 24-hour early warning, 72-hour notification, CSIRT/ENISA endpoint (art-140). Art. 14 obligations apply 11 Sep 2026. Zero network.

OpenChainGraph · 3 Steps compliance mandate EU CRA 2024/2847 Art.14 deadline 11 Sep 2026 SPDX · Annex I · Art.14 W3C VC §13.11 Hash-Anchored §4 chain_depth:3 · Zero PII

Chain Stages · 3 Steps

1ROOT · D0node

SPDX SBOM Validator (EU CRA Annex I) art-138

SPDX SBOM validity verdict feeds Annex I completeness checker

MCP Call · validate_spdx_sbom

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "validate_spdx_sbom",
    "arguments": {
      "sbom": {
        "spdxVersion": "SPDX-2.3",
        "SPDXID": "SPDXRef-DOCUMENT",
        "packages": [
          {
            "name": "express",
            "versionInfo": "4.18.2",
            "downloadLocation": "https://registry.npmjs.org/express/-/express-4.18.2.tgz"
          }
        ],
        "relationships": [
          {
            "spdxElementId": "SPDXRef-DOCUMENT",
            "relationshipType": "DESCRIBES",
            "relatedSpdxElement": "SPDXRef-Package-express"
          }
        ]
      }
    }
  },
  "id": 1
}

↓

2MIDDLE · D1node

CRA Annex I Completeness Checker art-139

Annex I gaps and conformity route feed vulnerability reporting readiness

MCP Call · check_cra_annex1_completeness

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "check_cra_annex1_completeness",
    "arguments": {
      "sbom_present": true,
      "sbom_machine_readable": true,
      "top_level_deps_covered": true,
      "vuln_handling_policy_present": true,
      "secure_by_default": true,
      "conformity_route": "self_assessment"
    }
  },
  "id": 2
}

↓

3TERMINAL · D2node

CRA Vulnerability Reporting Readiness (Art. 14) art-140

Article 14 readiness emits full CRA product conformance verdict — final stage

MCP Call · assess_cra_vuln_reporting_readiness

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "assess_cra_vuln_reporting_readiness",
    "arguments": {
      "actively_exploited_detection": true,
      "early_warning_24h_process": true,
      "notification_72h_process": true,
      "csirt_enisa_endpoint_configured": true,
      "coordinated_disclosure_policy": true
    }
  },
  "id": 3
}

Question: We ship a connected product into the EU. With the SBOM and hardening evidence on file, is our Annex I essentials evidence complete? Run the AINumbers MCP tool `run_chain` with {"chain":"cra-product-conformance"} and read `art-139-cra-annex1-completeness-checker.annex1_complete`. Verify: call `verify_execution_hash` (https://mcp.ainumbers.co/mcp) with `claimed_hash` set to `composite_execution_hash` and the full `composite_artifact`. Ledger, for a human re-check: https://ledger.ainumbers.co/ PII rule: send synthetic or anonymised inputs only. The MCP server runs these kernels and logs no payloads. Chain page: https://ainumbers.co/chaingraph/chains/cra-product-conformance.html

CRA Product Conformance (EU CRA Annex I + Art. 14)

Ask your agent