normakte / SBOM under the CRA
The Cyber Resilience Act makes the software bill of materials mandatory for all products with digital elements. Without it, neither vulnerability handling nor timely reporting is possible.
The manufacturer records the components contained in the product in an SBOM, in a commonly used machine-readable format, covering at least the top-level dependencies. The SBOM is part of the technical documentation and is provided to market surveillance authorities on request; it does not have to be published.
For software, build tools and package managers produce most of the component list automatically; for firmware and purchased modules you need your suppliers' data. What matters is that a matching SBOM is stored for every version you ship.
With the SBOM the manufacturer matches new vulnerabilities against its products. If a vulnerability is actively exploited, it shows within hours which products and versions are affected – the basis for the early warning within 24 hours.
| Content | Example |
|---|---|
| Component and version | openssl 3.0.13 |
| Supplier | publisher of the library or module |
| Unique identifier | e.g. package URL or CPE |
| Dependencies | which component includes which other |
| Format | CycloneDX or SPDX, machine-readable |
| Status | date and corresponding product version |
Register with all CRA requirements, classification, SBOM, reports with deadlines, support period and a target page for user information – one trial file free until 20.01.2027.
Source. Regulation (EU) 2024/2847, OJ L, 2024/2847 of 20.11.2024. Summarised; only the official text is authoritative. normakte is not legal advice.