Under the European Union's Cyber Resilience Act (CRA), I think the evidence that matters most is not a scanner report. It is a person's signed opinion. An Open Source Security Foundation (OpenSSF) post maps CRA due diligence onto the seven layers of its Gemara model, ending in an audit where someone reviews every gathered attestation and recommends whether the software is safe to use.
The detail worth slowing down for is in the middle. Scorecard, Minder, and Privateer can disagree about the same project, so the author suggests the internal policy name which tool is authoritative and how conflicts get settled. Buying scanners is easy. Deciding whose answer wins is judgment, and it rarely has an owner.
After years of chairing tooling and standards decisions for web teams, I have come to believe compliance work is mostly a question of who owns the decision, and the tools answer the easy half.
If nobody can say who signs that final opinion, I do not think the team is ready for the Act, however many checks it runs.
Photo source: https://photos.robertstowe.com/victoria