# Integrating 3rd-party components?

**URL:** <https://forums.balena.io/t/integrating-3rd-party-components/374111>\
**Category:** Component Integration & Supply Chain Security\
**Created:** [April 23, 2025, 2:31pm UTC](https://forums.balena.io/t/integrating-3rd-party-components/374111 "2025-04-23T14:31:50Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rmorillo24](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/rmorillo24/32/10359_2.png) [@rmorillo24](https://forums.balena.io/u/rmorillo24)\
**Post date:** [April 23, 2025, 2:31pm UTC](https://forums.balena.io/t/integrating-3rd-party-components/374111/1 "2025-04-23T14:31:50Z")

</div>

The CRA makes it clear: if you’re building products with digital elements, you’re also responsible for the components you integrate, even open-source ones.

Here’s what manufacturers are on the hook for:

- **Risk assess** components (including FOSS) and ensure they don’t compromise the product’s security.
- **Report vulnerabilities** in those components to whoever maintains them.
- **Share fixes** upstream if you patch a third-party component.
- **Maintain an SBOM** (Software Bill of Materials) to track what’s inside your product.
- **Document** everything in the technical file.

Gone are the days of “not my code, not my problem.” Whether you bundle a library, flash a chipset, or ship a container image — the CRA says: _you own the risk_.

So how are folks here dealing with this? Have you started generating SBOMs? What’s your plan for vetting or monitoring dependencies?