normakte / SBOM for machinery
The CRA requires a software bill of materials: which components are inside the control system, the HMI and the firmware. Without it, vulnerabilities can neither be found nor reported in time.
The manufacturer records the software components contained in the machine in an SBOM, in a commonly used machine-readable format and covering at least the top-level dependencies. The SBOM is part of the technical documentation; it does not have to be published.
Firmware of PLCs and drives, operating system and software of the industrial PC or HMI, your own control software and its libraries, remote-access routers and gateways. These parts often come from suppliers — you need their data.
CycloneDX and SPDX are widespread. What matters is that the list is machine-readable and updated with every software change.
The reporting obligation for actively exploited vulnerabilities has applied since 11 September 2026. If you do not know which component is in which machine, you cannot tell within 24 hours whether you are affected.
Record components, link them to the file, have them ready for reports.
Sources. Regulation (EU) 2023/1230, OJ L 165 of 29.6.2023; Regulation (EU) 2024/2847, OJ L, 2024/2847 of 20.11.2024. Summarised; only the official text is authoritative. normakte is not legal advice.