u/Thick_Bat3596

For companies selling software/connected products in the EU, how are you currently managing CRA compliance - documentation, SBOM, vulnerability handling/reporting, conformity, support lifecycle and evidence? What has been the most difficult part in practice?

For companies outside the EU selling software or connected products in the EU, what are the main CRA compliance requirements they need to manage—documentation, SBOM, vulnerability handling/reporting, support commitments, conformity assessment, etc.? What parts are actually difficult or painful to maintain in practice?