Meet your five-year CRA component duty with verified escrow.

A third-party component under the CRA’s Article 13(5) is any software or hardware sourced from outside your own development and integrated into your product with digital elements. Article 3(6) defines a component as software or hardware intended for integration into an electronic information system, so a licensed SDK, an embedded operating system, a protocol stack, a container base image, a package registry dependency, and an AI model all qualify.

CRA Third-Party Component Escrow is escrowed, versioned storage of the third-party and open-source components integrated into your product, together with the supplier documentation behind those components and a verification result confirming each deposit is complete. Codekeeper syncs the deposit as your components change and holds every version independently of your own systems and of the registries you pulled from.

Yes. The CRA’s Article 13(5) names them directly, including components of free and open-source software never made available on the market in the course of a commercial activity. So an open-source component can fall entirely outside the CRA, the maintainer of that component can hold no obligations under the Regulation, and your duty over that component still stands.

No. The CRA’s Article 13(5) places the duty on the manufacturer integrating the component, and Article 64(10)(b) exempts open-source software stewards from administrative fines altogether. A supplier failing upstream reduces nothing you owe, which is why an independent deposit of the components matters.

The CRA sets no retention period for the components themselves. What runs long is the duty attached to them. Article 13(8) requires you to handle vulnerabilities in your product and its components across your product’s whole support period, a minimum of five years, and Article 13(13) requires your technical documentation to stay at the disposal of market surveillance authorities for at least ten years or the support period, whichever is longer. Holding the components is how you stay able to meet the first duty.

Yes. The CRA’s Article 13(6) requires you to report the vulnerability to the person or entity manufacturing or maintaining that component, including an open-source component, and to remediate it under Annex I Part II. Where you developed a fix, you must share the relevant code or documentation with that maintainer, in machine-readable format where appropriate.

A scanner and an assessor tell you whether a component is safe to integrate; escrow holds the component and the record behind that decision. Codekeeper renders no judgment on your components or your suppliers. Most manufacturers need both: an assessment to run the check, and a deposit to keep the component reachable afterwards.

A deposit is held by an independent party, outside the systems that could lose the component and outside the registries that could withdraw it. Mirrors are pruned, repositories are migrated and retired, and version history usually breaks in the move. A review of a four-year-old product needs the components that shipped, which working infrastructure rarely still holds.

A component held in escrow stays reachable through a supplier ceasing to trade and through a registry withdrawal alike. The deposit continues independently of your supplier’s status and of whether the component remains published anywhere upstream, so the version you integrated is still retrievable. Without a deposit, a withdrawn component leaves you unable to evidence what you shipped and unable to rebuild the product to patch it.

It supports the CRA most directly, covering the component due-diligence duty under Article 13(5) and the component vulnerability-handling duty under Article 13(8). The same deposit serves the written-agreement duty in EU AI Act Article 25(4), supplier assessment under NIS2 Article 21(3), pre-contract due diligence under DORA Article 28(4)(d), ICT supply chain risk management under ISO 27001 A.5.21, and vendor risk assessment under SOC 2 CC9.2.