From NYC to Europe: We're Bringing Our CRA Reference Implementation to the LF Roadshow

We’re packing our bags again.

We just got back from a whirlwind trip to New York and haven’t even had time to shake the jet lag, but we’re immediately heading to Europe for the Linux Foundation Europe Roadshow.

Why the rush? Because the conversation happening there is at the very core of what we do at Chainloop.

The CRA Challenge: Compliance Without the Bottleneck

The event is focused on the Cyber Resilience Act (CRA). The CRA is a massive, necessary step forward for software security, and we fully support its mission. But it also introduces a significant challenge for enterprises: How do you prove compliance without grinding your development pipelines to a halt?

For too long, compliance has been a manual, after-the-fact process where teams still rely on dreaded, spreadsheet-based compliance methods. This old model of chasing down data and endless checklists is broken. It’s slow, it’s prone to error, and it creates friction between development, security, and compliance teams.

We believe compliance shouldn’t be a bottleneck. It should be an automated, built-in part of your software supply chain.

From Theory to Practice: Our CRA Reference Implementation

This isn’t just a theory for us. We’ve been focused on solving this, which is why we published an opinionated reference implementation for the Cyber Resilience Act.

This is a practical guide showing exactly how to use Chainloop to meet CRA requirements. It maps specific technical evidence—like SBOMs, vulnerability scans, and attestations—directly to the articles of the act, giving you a clear path to automation.

You can see the full reference implementation here: CRA Reference Implementation

To help you get started, we’ve also published a solution brief that outlines a 3-phase plan to move from manual spreadsheets to the automated, auditable system our reference implementation provides. You can read that here: Beat the CRA Deadline

Compliance as Policy-as-Code

We’re building the platform to turn compliance into policy-as-code. Instead of scrambling to collect evidence after the fact, you can:

Automatically collect SBOMs, vulnerability scans, and attestations during your CI/CD pipeline

Map evidence directly to regulatory requirements like CRA articles

Audit and prove compliance with an immutable, contextualized evidence store

Ship fast and stay compliant without manual overhead

Let’s Connect at the LF Europe Roadshow

If you’re attending the LF Europe Roadshow, let’s talk. We’d love to show you how you can ship fast and stay compliant—and share what we learned from our recent experiences in NYC.

See you there.