Software bill of materials (SBOM)
The SBOM is the inventory of the software in a product. It is a mandatory part of vulnerability handling and of the technical documentation, but it does not have to be published.
A software bill of materials, or SBOM for short, is a machine-readable list of the software components that make up a product. It shows which libraries, packages and dependencies the product contains and is the basis for tracking down vulnerabilities.
Definition in the Regulation
Annex I, Part II, point (1), of Regulation (EU) 2024/2847 requires manufacturers to identify and document vulnerabilities and components, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies. Under Annex VII, point (2)(b), the SBOM forms part of the technical documentation, and under Annex VII, point (8), it must be provided to the market surveillance authority upon a reasoned request. Recital 77 makes clear that manufacturers should not be obliged to make the SBOM public; Annex II, point (9), only requires information on where it can be accessed if the manufacturer makes it available to users. Article 13(24) empowers the Commission to specify the format and elements by implementing act; this has not happened so far.
What it means for manufacturers
There is no binding format yet. In Germany, the voluntary BSI TR-03183-2 (version 2.1.0 of 20 August 2025) names CycloneDX from version 1.6 or SPDX from version 3.0.1 and requires a separate SBOM for each software version, with mandatory fields such as creator, component name, version, licence and hash value. The technical guideline goes beyond the Regulation in depth: all of the manufacturer's own components in full, plus the first third-party component on each path. Vulnerabilities do not belong in the SBOM but in advisories or VEX documents. In practice, the SBOM is generated during the build and continuously checked against vulnerability databases. Firmware from suppliers should not be accepted without its own bill of materials. A match in that check does not yet trigger a reporting obligation; that only arises with active exploitation in your own product.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit