EU CRA SBOM Requirements: Overview & Compliance Tips
- The European Union’s Cyber Resilience Act (CRA) mandates that manufacturers of products with software components create and maintain a software bill of materials (SBOM).
- The CRA’s vulnerability and incident reporting obligations took effect on September 11, 2026. Its main requirements, including SBOM requirements, apply from December 11, 2027.
- The CRA reinforces the global trend toward software supply chain transparency via adoption of SBOMs.
A Quick History of SBOM Requirements in the EU
Before the EU Cyber Resilience Act (CRA), there were no specific, EU-wide legal requirements mandating the use of software bills of materials (SBOMs). However, there were related frameworks and industry guidance that touched on software supply chain transparency or product cybersecurity. Here’s a brief overview of what came before:
- EU Cybersecurity Act (2019): Established ENISA (the EU cybersecurity agency) as a permanent agency and created a voluntary cybersecurity certification framework for ICT products. SBOMs were not required, but some certification schemes encouraged component transparency as a best practice.
- ETSI Standards: ETSI (European Telecommunications Standards Institute) first published standards for consumer IoT security in June 2020. These recommended maintaining a list of third-party software and managing known vulnerabilities, which aligns with SBOM principles, but “SBOM” did not explicitly appear in the standards.
- NIS Directive (2016) and NIS2 (2022 update): Focused on network and information system security, particularly for essential services. While NIS2 raised expectations for software supply chain security, it still did not mandate SBOMs.
- BSI TR-03183 Part 2: Germany’s Federal Office for Information Security (BSI) publishes technical guidance on SBOM format and content to help manufacturers prepare for the CRA.
What Is the EU Cyber Resilience Act?
The EU Cyber Resilience Act (CRA) is a landmark regulation introduced by the European Commission to strengthen cybersecurity requirements for digital products sold in the EU. It applies to manufacturers, importers, and distributors of hardware and software with software components—ranging from smart devices to enterprise software—and requires them to build cybersecurity into their products from design through the entire lifecycle. The CRA’s goal is to reduce vulnerabilities, improve transparency around known risks, and ensure companies are accountable for maintaining product security, including after a product is released on the market.
By enforcing baseline security requirements and mandatory incident reporting, the CRA represents a shift from voluntary guidelines to legally binding obligations, positioning the EU as a global leader in regulating software and device security.
EU CRA Timeline
- Proposal Submission: September 15, 2022
- Political Agreement Reached: December 1, 2023
- European Parliament Approval: March 12, 2024
- Council Adoption: October 10, 2024
- Entry into Force: December 10, 2024
- Vulnerability and Incident Reporting Obligations Applicable From: September 11, 2026
- Main Obligations Applicable From: December 11, 2027
An Overview of What the EU CRA Says About SBOMs
Annex I, Part II, point (1) of the EU Cyber Resilience Act requires manufacturers of products with digital elements that fall within its scope to document components and vulnerabilities, including by creating an SBOM in a commonly used, machine-readable format covering at least the product’s top-level dependencies.
While the CRA does not require manufacturers to make the SBOM publicly available, they must include it in the product’s technical documentation and provide it to market surveillance authorities upon request. The European Commission is empowered to specify the exact format and elements of the SBOM, potentially aligning with international standards.
An Introduction to SBOMs
A software bill of materials (SBOM) is a detailed inventory of all the components that make up a software application, including libraries, packages, and dependencies. Much like an ingredient list for packaged food, an SBOM provides transparency into what’s inside a piece of software—critical for identifying and managing security vulnerabilities, especially in third-party or open-source code.
The EU Cyber Resilience Act is Here. Is Your Software Supply Chain Ready?
Steps to Prepare for the CRA SBOM Requirements
- Generate SBOMs for all software products: Create a software bill of materials for every digital product you manufacture or distribute in the EU. The SBOM should list all top-level software components and be formatted in a commonly used, machine-readable standard (e.g., SPDX, CycloneDX, or SWID). Ensure it’s included in your product’s technical documentation.
- Automate vulnerability scanning: Use automated tools to continuously scan components listed in your SBOMs for known vulnerabilities. Integrate scanning into your CI/CD pipeline to detect issues early and maintain a real-time view of software risks.
- Maintain a secure software development lifecycle (SSDLC): Embed security best practices throughout the product development process—from design and coding to testing and deployment. This includes threat modeling, code reviews, dependency management, and secure update mechanisms.
- Document security policies and remediation processes: Maintain clear internal documentation outlining your approach to identifying, assessing, and remediating vulnerabilities. This documentation may be requested by market surveillance authorities under the CRA.
- Don’t just document—automate compliance policy enforcement with Anchore Enforce‘s policy engine and policy-as-code language (i.e., DSL)
- Collaborate with suppliers and partners on SBOM exchange: Ensure you can access and verify SBOMs from upstream software vendors and third-party suppliers. Establish trusted, standardized channels to receive, share, and validate SBOM data across your software supply chain.
- Learn how Anchore SBOM automates SBOM ingest (in all standard formats) and SBOM export to downstream customers of your product/service (in the vendors preferred format)
CRA SBOM Compliance Checklist for Manufacturers (by December 2027)
- Generate a software bill of materials (SBOM) for each product
- Include top-level software components
- Use a commonly used, machine-readable format (e.g., SPDX, CycloneDX)
- Include the SBOM in the product’s technical documentation
- Make documentation available to EU market surveillance authorities upon request
- Keep SBOMs up to date throughout the product lifecycle with regular or automated SBOM management
- Reflect changes due to patches, component updates, or software modifications
- Request SBOMs or component lists from third-party suppliers for supply chain coordination
- Ensure third-party software components are accounted for in your own SBOM
- Monitor developments from the European Commission regarding specific SBOM format requirements
- Be prepared to align with additional formatting or content specifications as they are released
Final Thoughts
The Cyber Resilience Act reinforces the global movement toward greater transparency in the software supply chain. By proactively integrating SBOMs into your development and documentation processes now, your organization can stay ahead of compliance requirements and reduce risk. Taking early action not only streamlines future audits and reporting but also helps avoid costly remediation efforts and potential non-compliance penalties down the line.
This checklist maps a direct path from legal mandates to technical execution, helping Engineering and SecOps teams shift from reactive scanning to a proactive, audit-ready architecture.
CRA SBOM Requirement FAQs
Does the EU Cyber Resilience Act require an SBOM?
Yes. Annex I, Part II, point (1) requires manufacturers of products within the CRA’s scope to create a machine-readable SBOM covering at least top-level dependencies.
When do the CRA’s SBOM requirements apply?
The SBOM requirement applies from December 11, 2027, alongside the CRA’s main obligations. Manufacturers’ vulnerability and incident reporting obligations began on September 11, 2026.
Does the CRA require a specific SBOM format?
The CRA requires a commonly used, machine-readable format. Common formats include SPDX and CycloneDX. The regulation empowers the European Commission to specify the SBOM’s format and elements through implementing acts. You can learn more about SBOM Standards and Formats here.
Does following BSI TR-03183-2 establish CRA compliance?
No. BSI TR-03183-2 is technical guidance. Following it does not, by itself, establish CRA compliance or provide a presumption of conformity.
What tools can help companies meet Cyber Resilience Act compliance requirements?
Solutions like Anchore Enterprise make it easy for manufacturers to meet Cyber Resilience Act compliance requirements by automating SBOM generation and management, continuously monitoring software components for known vulnerabilities, and enforcing security policies throughout the development lifecycle.
