CRA Evidence OS

CRA Evidence OS turns scattered security documents into cited, review-ready CRA evidence for small EU software and device manufacturers using GPT-5.6.

Comment

Inspiration## Inspiration

Small manufacturers do not necessarily lack security information. They lack evidence continuity.

Architecture documents, SBOMs, vulnerability records, risk decisions, release notes, and patch histories are often stored in different tools and become outdated as products change. Preparing this information for a consultant, importer, auditor, or conformity assessment can become a slow manual process.

The EU Cyber Resilience Act makes this problem increasingly important for manufacturers of software and connected products. Its reporting process can require an early warning within 24 hours and a more complete notification within 72 hours for relevant incidents and actively exploited vulnerabilities.

We wanted to explore a practical question:

Can AI help a small manufacturer maintain review-ready security evidence without pretending to replace security experts, legal advisers, or conformity assessors?

That question became CRA Evidence OS.

What it does

CRA Evidence OS is a documentation and evidence workspace for small EU software, IoT, and industrial-equipment manufacturers.

The guided demo follows one connected workflow:

  1. Evidence Review — GPT-5.6 converts a controlled technical source into structured, cited evidence suggestions.
  2. Human Approval — suggestions remain untrusted until a person reviews and approves them.
  3. Evidence Graph — approved claims are connected to their sources, product versions, components, and security controls.
  4. SBOM Impact — when a component or version changes, deterministic graph logic identifies which evidence may have become stale.
  5. Incident Draft — approved facts are assembled into a structured 24/72-hour reporting record, while missing information remains explicitly marked as unknown.
  6. Dossier Export — the workspace prepares traceable records that can be shared for further professional review.

The product does not claim to certify CRA compliance. It helps teams prepare, connect, review, and maintain the evidence required for compliance work.

How we built it

CRA Evidence OS is a focused vertical MVP built with Codex and GPT-5.6.

The application uses Next.js, React, TypeScript, server-side API routes, structured schemas, an evidence store, and the OpenAI Responses API.

GPT-5.6 is used only where language reasoning adds value:

  • extracting structured evidence suggestions;
  • connecting suggestions to exact source references;
  • explaining why a product change affects existing evidence;
  • drafting incident-reporting records from approved facts.

Deterministic code handles state transitions, approval status, dependency relationships, stale-evidence detection, tenant boundaries, and export structure.

Model responses are validated against strict schemas. Citations are checked against known source identifiers, secrets remain server-side, and model suggestions cannot silently become approved compliance evidence.

Codex helped accelerate the architecture, interface implementation, API integration, structured-output schemas, security boundaries, testing strategy, documentation, and deployment workflow.

The most important product decisions remained human decisions: prioritizing provenance over generic AI answers, separating model reasoning from deterministic graph logic, requiring human approval, and preserving unknown facts instead of allowing the model to invent them.

Challenges

The largest challenge was avoiding the creation of another compliance chatbot.

A fluent answer is not enough for a regulated business process. Every useful claim needs a visible source, version, review state, and history.

Another challenge was separating responsibilities correctly. GPT-5.6 is useful for interpreting technical language and preparing structured drafts, but it should not determine approval status or silently change compliance records. We therefore designed AI output as a suggestion layer around a deterministic evidence system.

We also had to balance public judge access with security. Production workflows require identity and tenant isolation, while the competition demo needs a safe synthetic path that judges can test without accessing private data.

Finally, we had to keep the project honest. The current version is a controlled synthetic vertical slice, not a finished commercial compliance platform or a universal document-ingestion system.

What we learned

We learned that the most valuable AI feature in compliance software may not be text generation. It may be the ability to show:

  • where a claim came from;
  • whether a human approved it;
  • which product version it describes;
  • what changed after approval;
  • and which records must now be reviewed again.

We also learned that preserving uncertainty is a product feature. In an incident workflow, clearly displaying “unknown” is safer and more useful than generating a confident but unsupported answer.

Finally, Codex was most effective when paired with explicit product boundaries, executable tests, and continuous review rather than being treated only as a code generator.

Accomplishments

During Build Week, we created a coherent end-to-end workflow that connects evidence extraction, human review, dependency-aware change impact, incident preparation, and dossier export.

We are especially proud that the system distinguishes between:

  • source facts;
  • GPT-5.6 suggestions;
  • human-approved evidence;
  • deterministic impact results;
  • stale records;
  • and unresolved information.

This makes the application more than a static document generator.

What’s next

The next steps are broader document ingestion, SPDX and CycloneDX SBOM support, GitHub and GitLab integrations, vulnerability-feed connectors, stronger multi-tenant access controls, reviewer collaboration, versioned exports, and mappings to official CRA documentation templates.

The long-term goal is to make evidence maintenance a continuous product-security workflow instead of an emergency documentation project performed immediately before an audit or incident.

CRA Evidence OS is not legal advice or a conformity assessment. It is a human-reviewed evidence preparation tool.

Built With

Share this project:

Updates