BSI TR-03183
The CRA says what to do, not how. In Germany, the BSI fills that gap with TR-03183: SBOM format, security.txt, response times for vulnerability reports.
BSI TR-03183 ("Cyber Resilience Requirements for Manufacturers and Products") is the technical guideline of the German Federal Office for Information Security (BSI) that translates the requirements of the Cyber Resilience Act into practice. It is voluntary and does not give rise to a presumption of conformity.
Definition in the Regulation
The Regulation does not refer to the guideline; it is national guidance. Four parts have been published. Part 1 (general requirements, version 1.0.0, published on 5 August 2026) explains Annex I for manufacturers. Part 2 (SBOM, version 2.1.0 of 20 August 2025) sets out the format and mandatory fields of the software bill of materials: CycloneDX 1.6 or later or SPDX 3.0.1 or later, one SBOM per software version, without vulnerability information. Part 3 (vulnerability reports and notifications, version 1.0.0 of 20 August 2025) requires a security.txt under RFC 9116 with separate addresses for the PSIRT and CSIRT, and a web form for anonymous reports. It also requires a first, non-automated response within five working days, detailed feedback within ten working days and disclosure of validated vulnerabilities within 90 days. Part H (version 1.1.0 of 27 February 2026) describes the route via a quality assurance system under module H.
What it means for manufacturers
The TR is not law, but it is the only official guidance of its kind in Germany, and under the draft German CRA implementation act (CRA-Durchführungsgesetz) the BSI is to become the market surveillance authority. If you set up your reporting address according to Part 3 and your SBOM according to Part 2, you have a solid answer when the authority asks about the state of the art. It does not give a presumption of conformity under Article 27; that is reserved for harmonised standards, and none had been published in the Official Journal as of October 2026. The BSI is developing the TR step by step.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit