Overview
The EU Cyber Resilience Act (Regulation 2024/2847) is a binding EU regulation that establishes cybersecurity requirements for products with digital elements - essentially any hardware or software product sold in the EU market.
It was published in the Official Journal of the EU in November 2024, with a phased enforcement timeline through 2027.
Key SBOM requirements
The CRA explicitly requires manufacturers to:
- Produce a machine-readable SBOM in a commonly used format (e.g., CycloneDX, SPDX) identifying components and dependencies in their products
- Cover at least top-level dependencies of the product
- Document vulnerabilities and provide timely security updates
- Report actively exploited vulnerabilities and severe incidents within 24 hours, through the ENISA Single Reporting Platform
- Maintain cybersecurity throughout the product’s expected lifetime
Reporting is not sent to ENISA directly: notifications go through the Single Reporting Platform to the CSIRT designated as coordinator in the relevant Member State, and are made available to ENISA at the same time (Article 16(1)).
Germany’s BSI has published TR-03183-2, which provides concrete technical specifications for CRA-compliant SBOMs, including:
- Format: CycloneDX 1.6+ or SPDX 3.0.1+ in JSON or XML
- Depth: Recursive dependency resolution down to and including the first component outside the scope of delivery
- Required fields per component: Creator, name, version, filename, dependencies, licences (as SPDX identifiers), SHA-512 hash, and executable/archive/structured properties
- No vulnerability data in SBOMs - use CSAF or VEX instead
Who does it apply to?
The CRA applies to:
- Software vendors selling products in the EU (including SaaS with on-premise components)
- Hardware manufacturers with embedded software
- Open-source projects distributed commercially (non-commercial open source has exemptions)
Timeline
- 11 September 2026 - Article 14 reporting obligations begin for manufacturers, filed through the ENISA Single Reporting Platform
- 11 December 2027 - Full application: all essential requirements, including the SBOM obligation, become enforceable
- 11 December 2027 - Reporting obligations for open-source software stewards begin (Article 24(3))
How sbomify helps
sbomify provides tooling to help you prepare for CRA compliance:
- Manage and monitor SBOMs across your product portfolio
- Track vulnerability status with automated scanning
- Share compliance artifacts through your Trust Center
- CRA compliance plugin to assess your SBOM against CRA requirements
For the complete breakdown of CRA requirements and field mappings, see our detailed EU CRA Compliance Guide.
FOSDEM 2026: CRA-Ready SBOMs
For a practical walkthrough of CRA-ready SBOM generation, watch our FOSDEM 2026 talk: