The Software Bill of Materials is a core part of the CRA. We have covered this in our SBOM live podcast earlier. The discussion lives on, as there are not much guidelines. What is the bare minimum? The answer can be divided in many parts. The CRA mentions an SBOM that the market authorities will need access to if there’s an issue. But the manufacturer is still responsible for all the components in the product, including the first party code produced by the manufacturer. In order to work with that, to make sure compliance and vulnerability management works, a full SBOM is needed both in the source code mode and in the build and delivery phase. These SBOMs may be different versions of the data.
Let’s meet at SBOM Focus and discuss this! See you in Stockholm April 10th, 2026!
