This product was placed on the EU market before 11 December 2027 and you do not expect any substantial modification.
In this case, the full CRA requirements do not apply.

However, a few obligations still apply:
• Mandatory vulnerability & incident reporting (from 11 September 2026).

All manufacturers must report actively exploited vulnerabilities and severe cybersecurity incidents, even for legacy products.

• Maintain visibility into your software components.

To meet reporting and remediation expectations, you still need accurate SBOM visibility to quickly assess exposure when new CVEs emerge.

Keysight SBOM Manager helps you meet this requirement through continuous vulnerability monitoring across all component versions, automatic CVE correlation, and ready‑to‑share SBOM/VEX documentation.