CRA retention not covered

[NorioKobota]

[File URL / Relevant Section Number]
https://github.com/OpenChain-Project/SBOM-wg/blob/main/Cross-Industry-SBOM-Quality-Guide/en/chapters/03-guidelines-to-enhance-sbom-document-quality.md

[Subject Text]
Need to add in Chapter 3?

[Comments / Suggested Changes]
The retention obligations are not addressed. The CRA mandates ten years or the product support period, whichever is longer.

[Comments from]
Ibrahim Haddad

[Dates]
2026-04-07

[NorioKobota]

We agree that retention requirements are important for CRA compliance. However, document retention is primarily a process and governance requirement rather than an SBOM document quality requirement. Therefore, it is currently outside the scope of this guide, although we may consider addressing it in future versions.