Yes, the EU Cyber Resilience Act requires manufacturers to draw up an SBOM. Annex I asks for a commonly used, machine-readable format covering at the very least the top-level dependencies. Manufacturers are not obliged to make it public, and authorities can ask for it on a reasoned request.
The clauses that matter
Definition. Article 3 defines a software bill of materials as "a formal record containing details and supply chain relationships of components included in the software elements of a product with digital elements."
The duty. Annex I, Part II (vulnerability handling) says manufacturers shall "identify and document vulnerabilities and components contained in products with digital elements, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the products."
Technical documentation. Annex VII lists, where applicable, the SBOM "further to a reasoned request from a market surveillance authority," provided it is necessary for the authority to check compliance. The vulnerability handling information in the documentation refers to the SBOM as part of the manufacturer's processes.
Confidentiality. Recital 77 says "Manufacturers should not be obliged to make the SBOM public." Annex II, the user information, includes a point asking, if the manufacturer decides to make the SBOM available to the user, for information on where it can be accessed.
Format and elements. Article 13 says the Commission may, through implementing acts, specify the format and elements of the SBOM referred to in Annex I, taking into account European or international standards and best practices.
What it does not say
The Act does not name a format such as SPDX or CycloneDX. It does not require depth below top-level dependencies, though that is a floor, not a ceiling. It does not require a manufacturer to send an SBOM to every customer.
Dates
Per Article 71, the Regulation applies from 11 December 2027. Article 14 on reporting applies from 11 September 2026, and the chapter on notification of conformity assessment bodies from 11 June 2026. The SBOM duty sits in Annex I, so it follows the general application date.
What to do with this
- Treat the top-level dependency list as the least you must hold, and aim for full transitive coverage if you want it to be useful. CISA's 2026 text says there is no minimum depth for a good SBOM.
- Keep it current with each release, as it is part of your technical documentation.
- Decide who answers a market surveillance request.
- Do not promise customers a public SBOM because the Act asks for one. It does not.
For Germany's technical guidance on the same topic, see BSI TR-03183 explained. For a side by side view, see SBOM rules compared across the US, EU, Germany and India.
This is a reading of the regulation text and not legal advice. Check scope and product class with counsel.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through to see how one control or duty maps across several frameworks, and notice which duties repeat.
Quick check
Does the CRA require a public SBOM?
No. Recital 77 says manufacturers should not be obliged to make the SBOM public.
Is a list of direct dependencies enough?
Annex I sets top-level dependencies as the minimum. Fuller coverage is more useful for vulnerability handling.
Sources
Last reviewed: 19 October 2026.
