CRA software bill of materials

The CRA requires an SBOM in technical documentation. It does not name a file format or require publication

Direct answer. Annex I Part II, point (1), of Regulation (EU) 2024/2847 says manufacturers shall identify and document vulnerabilities and components contained in products with digital elements, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the products. Article 3(39) defines that bill as a formal record of components and their supply-chain relationships. Annex VII, point 2(b), puts the software bill of materials in the technical documentation. Article 13(13) says manufacturers keep that documentation at the disposal of market surveillance authorities. Annex VII, point 8, and Article 13(22) cover providing it further to a reasoned request. Annex II, point 9, speaks of making the bill available to the user only if the manufacturer decides to do so. The regulation does not name SPDX, CycloneDX, or another format. Application dates are not restated here. This page is not legal advice.

CRALedger Duty Records (Shopify App Store · Write a review) tracks product roles, checklists, and open record gaps, Article 14 incident deadlines, encrypted ENISA draft packs, vulnerability forwarding, and audit records. The listing does not say the app draws up a software bill of materials or files a notification. Manufacturer articles are CRA manufacturer obligations.

Related: EUDR Records Manager — DDS reference numbers on supplier lots.

Free check first: CRA role and scope self-check runs in your browser and sends nothing. Describe a product and your role and see which articles of Regulation (EU) 2024/2847 to read.

Checklist before you treat a file as the SBOM

Annex I: identify components, including by an SBOM

Part II of Annex I is headed “Vulnerability handling requirements”. It says manufacturers of products with digital elements shall, at point (1), identify and document vulnerabilities and components, including by drawing up the software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies. Article 13(2) ties the manufacturer’s vulnerability handling to that Part II. The Commission’s Cyber Resilience Act page and legislative summary describe the same documentation duty at a high level. Annex numbers on this page are the EUR-Lex annexes.

Article 13(24) says the Commission may, by implementing acts that take account of European or international standards and best practices, specify the format and elements of the software bill of materials referred to in Part II, point (1), of Annex I. Until such an act specifies a format, the regulation’s own words remain “a commonly used and machine-readable format”. Names such as SPDX or CycloneDX are examples people use. They are not mandated by the text opened here.

Technical documentation, and a request rather than publication

Article 31 says the technical documentation shall at least contain the elements set out in Annex VII. Annex VII, point 2(b), includes the software bill of materials among the specifications of the vulnerability handling processes. Article 13(13) says manufacturers shall keep the technical documentation and the EU declaration of conformity at the disposal of the market surveillance authorities for at least 10 years after the product has been placed on the market or for the support period, whichever is longer.

Article 13(22) says manufacturers shall, upon a reasoned request from a market surveillance authority, provide that authority with all the information and documentation necessary to demonstrate conformity. Annex VII, point 8, lists, where applicable, the software bill of materials further to a reasoned request from a market surveillance authority, provided it is necessary for that authority to check compliance with Annex I. Article 13(25) is a further request path: for a Union-wide dependency assessment, market surveillance authorities may request the relevant software bills of materials. Annex II, point 9, says that if the manufacturer decides to make the software bill of materials available to the user, the user information states where it can be accessed. That “if” is not a duty to publish the bill. Exporting the records you do keep is CRA record packs.

What this page is not

Related pages

Not legal advice. Confirm Annex I Part II, Annex VII, and Article 13 on EUR-Lex, and the Commission pages, before you treat a file format as mandatory or an SBOM as something you must publish. The app tracks duty records you enter. It does not generate an SBOM or file a notification.

To keep CRA vulnerability reports and deadlines in one place on Shopify, see CRALedger.