Your CI pipeline is the only place a CRA-compliant SBOM can live

Most compliance requirements can be satisfied by a document. You write it, someone signs it, it goes in a folder, and it is true for a year. The software bill of materials required by CRA Annex I Part