What the Cyber Resilience Act expects

The Act expects manufacturers to identify and document the components in their products, including by drawing up a software bill of materials in a commonly used, machine-readable format covering at least the top-level dependencies. The reading of the text that practitioners offer is that it must be available to authorities on request rather than necessarily published, but check the Act and Commission guidance for your situation.

Full application is on 11 December 2027, but customers, especially in regulated sectors, already ask for SBOMs in security questionnaires.

Machine-readable means one of the established formats, most commonly SPDX or CycloneDX. A spreadsheet assembled by hand does not count and goes stale immediately.

How to produce an SBOM that is worth having

Generate it in the build pipeline so it reflects what was actually compiled and shipped. Include component names, versions, suppliers where known, hashes, and license information. Cover transitive dependencies as well as direct ones where your tooling allows, because that is where surprises hide, even though the Act sets only a minimum.

Attach one SBOM to each release and store it with the artifact so you can answer which versions of which products contain a component. Check the output for gaps, such as components pulled in by container images or vendored code.

Per release, from the build

Automate generation so the SBOM always matches the artifact.

Searchable inventory

Load SBOMs into a store so you can find every product with a vulnerable component in minutes.

Connect it to vulnerability handling

An SBOM tells you what is inside. It does not tell you whether a known vulnerability actually affects your product. Pair it with a way to record exploitability, such as vulnerability exploitability exchange statements, so customers can see which advisories matter and which do not.

Together these answer the questions buyers care about: what is in the product, which issues apply, and how fast you respond. Our article on vulnerability handling explains the process that sits behind that.

Need SBOM generation and vulnerability tracking in your pipeline? Talk to our DevOps team.

Key takeaways

  • The CRA expects a machine-readable SBOM covering at least top-level dependencies; SPDX and CycloneDX are the common formats.
  • Generate it in the build for every release and store it with the artifact.
  • Aim for transitive coverage, hashes, versions, and licenses where possible.
  • Pair it with exploitability statements and a searchable inventory so it answers real questions.
This is general information, not legal advice. Check Regulation (EU) 2024/2847 and Commission guidance for exact SBOM obligations and availability requirements.