CRA SBOM Requirements: What Annex I Actually Asks For
Updated 20 September 20263 min read
The Cyber Resilience Act makes a software bill of materials a legal requirement for manufacturers of products with digital elements. The requirement is shorter, and in some ways narrower, than many summaries suggest.
The text
Annex I, Part II, point 1: manufacturers shall identify and document vulnerabilities and components contained in their products, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the products.
| Words | What they mean in practice |
|---|---|
| Commonly used | A recognised standard format. SPDX and CycloneDX are the two most widely used |
| Machine-readable | A file a tool can parse, not a spreadsheet or a PDF |
| At the very least the top-level dependencies | The legal minimum. Going deeper is your choice, not an obligation |
Must it be public?
No. Recital 77: manufacturers are not obliged to make the SBOM public.
- It belongs in the technical documentation, as part of the vulnerability handling information (Annex VII, item 2).
- It must be provided to a market surveillance authority further to a reasoned request (Annex VII, item 8).
- If you choose to make it available to users, the user information must say where it can be accessed (Annex II, item 9).
Why it is not just paperwork
An SBOM generated once and filed away helps nobody. Its real job is to feed vulnerability monitoring: you cannot know that a component in your product is being exploited if you do not know the component is there. And that is what makes the Article 14 reporting obligations achievable.
Inventory, monitoring, reporting: one chain. A break anywhere breaks all three.
Four practical rules
- Generate it in the build pipeline, not by hand. A hand-assembled SBOM is out of date the next time a dependency moves.
- Generate it from the artefact you actually ship, not from a nearby build.
- Regenerate it at every release that changes the product's composition.
- Store it with the release, bound to the version, so you can show what was inside on the day it shipped.
When it applies
The SBOM is part of the Annex I Part II vulnerability handling requirements. The Commission's guidance (C(2026) 5252, paragraph 210) confirms that for products placed on the market before 11 December 2027, those Part II obligations do not apply.
But the reporting obligations of Article 14 already apply to those same products — and without an inventory of components, you have no reliable way of knowing when you have something to report.
Sources
- Regulation (EU) 2024/2847, Annex I Part II point 1; Annex II item 9; Annex VII items 2 and 8; recital 77 — Official Journal of the European Union
- European Commission, Guidance on the application of the CRA, C(2026) 5252, paragraph 210
Position as at 20 September 2026. General information, not legal advice.