What is an SBOM, and does the Cyber Resilience Act require one?

A software bill of materials (SBOM) is a machine-readable list of the components inside a piece of software, such as libraries and their versions, much like an ingredients list. It lets a manufacturer, and anyone it shares the list with, find out quickly whether a newly published vulnerability affects a product. The CRA requires manufacturers to identify and document the components in their products, including by drawing up an SBOM in a commonly used, machine-readable format that covers at least the top-level dependencies. It forms part of the technical documentation; the Act does not require the manufacturer to publish it, although authorities can ask for it. If you buy software, ask suppliers whether they keep an SBOM and how they use it to track vulnerabilities, rather than insisting on receiving the file itself. Common formats include CycloneDX and SPDX. NetSenX does not generate SBOMs for your products, and a network sensor cannot see which libraries are inside an application.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 20 questions on EU law: GDPR, DORA, CRA and AI ActAll topics