The compliance vault is most effective when used as a routine part of your release and compliance workflow. Recommended practices:

Pre-market snapshot. Before placing a product on the EU market, generate a snapshot that captures the complete Technical File, SBOM, vulnerability assessment, and Declaration of Conformity. This is your baseline evidence for CRA Article 13(10).
Post-release snapshots. After each significant release, generate a new snapshot. This creates a versioned evidence trail showing how compliance evidence evolved over the product lifecycle.
Post-remediation snapshots. After resolving critical or high-severity vulnerabilities, generate a snapshot to demonstrate that the product was returned to a compliant state. This supports CRA Article 13(6) (vulnerability handling) evidence.
Annual review. Generate at least one snapshot per year during the support period to demonstrate ongoing compliance monitoring, even if no major changes have occurred.

When preparing for an audit or market surveillance inquiry, export the relevant snapshots and provide them alongside the signature files and public keys. The auditor can independently verify the content hash and digital signatures without needing access to CRANIS2.

Snapshots are retained for the duration documented in the Privacy Policy. The 10-year retention period required by CRA Article 13(10) is measured from the date of market placement or the end of the support period, whichever is later.

10-year compliance vault

Select a station to begin