EU Cyber Resilience Act
EU Cyber Resilience Act
Product statement and readiness position
I. SCOPE AND ROLE
Infragistics develops and licenses user interface component libraries and developer tooling. In respect of the products it places on the EU market, Infragistics is a manufacturer of products with digital elements within the meaning of Regulation (EU) 2024/2847 (the Cyber Resilience Act).
Infragistics component libraries are licensed to software developers, compiled into the developer's application, and redistributed as part of that application. They are not a service, not a server product, and are not independently deployable. They execute in-process within the host application, under that application's identity, privileges and security context, and expose no network listening services and no authentication or authorization boundary of their own.
This statement covers the products for which Infragistics publishes Software Bills of Materials, listed at infragistics.com/legal/sbom.
II. REGULATORY TIMELINE
| Date | What applies |
|---|---|
| 10 Dec 2024 | The CRA entered into force. |
| 11 Sep 2026 | Article 14 reporting obligations apply. Manufacturers must report actively exploited vulnerabilities and severe incidents to their designated CSIRT coordinator and ENISA. |
| 11 Dec 2027 | From this date, the essential cybersecurity requirements, conformity assessment and CE marking requirements become mandatory for products placed on the EU market. Infragistics intends to complete its conformity programme and make CE-marked releases available before this date. |
III. CURRENT POSITION
The following are in place today and address the CRA's component inventory, secure development, vulnerability handling and transparency requirements.
Infragistics publishes a CycloneDX 1.6 Software Bill of Materials for every current product release at infragistics.com/legal/sbom. Each document validates against the official CycloneDX schema and enumerates package identity (PURL), version, license and the resolved dependency graph, with SHA-256 and SHA-512 hashes on first party packages. Third party dependencies are enumerated by evidence. Documents are regenerated at each release.
Development is carried out on GitHub Enterprise with GitHub Advanced Security, providing static application security testing, secret scanning, and dependency alerting and remediation across the components enumerated in the published SBOMs, together with peer code review.
Infragistics publishes its product lifecycle at infragistics.com/support/product-lifecycle, stating for each release the release date, the final service release date and the support expiry date.
Reported vulnerabilities are triaged and remediated, with remediation delivered through service releases on supported product versions. Security reports may be submitted to support@infragistics.com.
IV. ARTICLE 14 REPORTING
From 11 September 2026, where Infragistics becomes aware of an actively exploited vulnerability in its products or a severe incident affecting their security, Infragistics reports through the ENISA Single Reporting Platform, which routes the notification simultaneously to its designated CSIRT coordinator and to ENISA: an early warning within 24 hours, a notification within 72 hours identifying the product and the nature of the vulnerability together with any corrective or mitigating measures, and a final report within 14 days of a corrective measure being available (one month for a severe incident).
In parallel, Infragistics informs impacted users of the vulnerability or incident and of any mitigating or corrective measures available to them. Notification is issued to the registered contacts on the customer account and through a published security advisory identifying affected products and versions, severity, and the available fix or mitigation. Customers may nominate a dedicated security distribution address to receive these notifications.
V. CUSTOMERS INTEGRATING INFRAGISTICS COMPONENTS
A product that incorporates Infragistics redistributable components and is placed on the EU market is, for CRA purposes, a product placed on the market by that customer, who carries the manufacturer obligations for it. Article 13(5) requires manufacturers to exercise due diligence when integrating components sourced from third parties so that those components do not compromise the cybersecurity of the product.
To support that due diligence, Infragistics recommends that customers:
- Record the specific Infragistics product versions incorporated into each of their own products, using file and assembly version metadata rather than assembly names, which do not always carry a version.
- Reference the published SBOM for each version in use and confirm that version remains within its published support window.
- Plan version uplift on a cadence aligned to the published lifecycle. A multi-year subscription entitles a customer to every release issued during its term but does not extend the service release window of any individual release. Remaining on a release beyond its support expiry means no service release vehicle exists through which a vulnerability in that version could be remediated.
- Nominate a security contact to receive vulnerability notifications.
VI. STATUS OF THIS STATEMENT
This statement describes the current architecture, published artifacts and CRA readiness position of the products covered. It is not an EU Declaration of Conformity and does not claim that the releases available at the date of this statement have undergone CRA conformity assessment or carry CRA CE marking.
Infragistics has a programme underway to meet its obligations under the CRA and intends to make CE-marked releases available before the applicable requirements become mandatory on 11 December 2027.
VII. ROADMAP TO CE MARKING
Infragistics intends to CE mark its products under the Cyber Resilience Act and to have CE-marked releases available before the 11 December 2027 application date.
Infragistics products fall within the CRA default category. They are not important products within the meaning of Annex III, nor critical products within the meaning of Annex IV. Conformity assessment is therefore carried out using the internal control procedure under Module A and does not require the involvement of a notified body.
Our programme comprises a gap assessment against the essential cybersecurity requirements in Annex I, Parts I and II; determination and publication of the support period; compilation of the technical documentation required by Annex VII; completion of the internal conformity assessment; and issuance of the EU Declaration of Conformity, after which CE marking is applied to releases.
This roadmap is reviewed and updated as the programme progresses. Customers incorporating Infragistics components into their own products may reference it in support of their own conformity planning and third-party component due diligence.