What is an SBOM and does the CRA require one?

A software bill of materials is a machine-readable inventory of a product's components. The CRA's vulnerability-handling requirements (Annex I, Part II) expect manufacturers to produce and maintain one in a common format such as CycloneDX or SPDX.

Which SBOM format does the CRA require?

The regulation requires a commonly used, machine-readable format rather than mandating one specifically; CycloneDX and SPDX are the widely accepted options.

CRA guide

SBOM for the CRA: formats, requirements, and how to generate one free

An SBOM is the first evidence artifact of CRA compliance — everything else in the vulnerability-handling process depends on having an accurate one.

What the CRA requires

CRA Annex I, Part II, (1) expects manufacturers to maintain a software bill of materials as part of the vulnerability-handling process — a machine-readable inventory covering at least the product's top-level dependencies, kept current as the product changes.

Which format

The regulation calls for a “commonly used, machine-readable format” rather than naming one outright. CycloneDX and SPDX are the two established choices, and either satisfies the requirement.

The format matters because the SBOM isn't the end goal — it's what lets you track CVEs against your actual components. An SBOM you can't diff or query against a vulnerability feed doesn't do the job.

Generate one free

Normproof's OSS SBOM/scan CLI and GitHub Action generate a CycloneDX and SPDX SBOM directly from your build — one command in CI, no account required. It's the same generation path the paid product uses for the technical documentation and dossier, so the SBOM referenced in your Annex VII documentation (item 2(b)) is the one actually produced from your real build artifact, not a manually assembled list.

Key points

Required by CRA Annex I, Part II, (1) as part of vulnerability handling.
Machine-readable format — CycloneDX or SPDX.
At least top-level dependencies; regenerate it as the product changes.
Feeds the vulnerability-handling record required in Annex VII technical documentation.

Frequently asked questions

What is an SBOM and does the CRA require one?: A software bill of materials is a machine-readable inventory of a product's components. The CRA's vulnerability-handling requirements (Annex I, Part II) expect manufacturers to produce and maintain one in a common format such as CycloneDX or SPDX.
Which SBOM format does the CRA require?: The regulation requires a commonly used, machine-readable format rather than mandating one specifically; CycloneDX and SPDX are the widely accepted options.

General information about the EU Cyber Resilience Act — not legal advice. Normproof provides tooling and audit-ready evidence; the manufacturer self-declares conformity. For your specific product, run the free readiness check or consult a qualified advisor.