BSI TR-03183 is a technical guideline from Germany's Federal Office for Information Security that interprets the EU Cyber Resilience Act's requirements for manufacturers. Part 2 covers SBOMs. BSI states it is a guide, not binding, and cannot be used as a presumption of conformity.
The parts
According to BSI's page, the guideline has these parts and versions:
- Part 1, General Requirements. Based on the CRA's articles and annexes. Described as a living document at version 1.0.0.
- Part 2, Software Bill of Materials. Current version 2.1.0.
- Part 3, Vulnerability Reports and Notifications. Version 1.0.0, covering how to handle incoming vulnerability reports.
- Part H. Version 1.1.0, an approach for showing CRA conformity under the full quality assurance route (Module H) using an ISO/IEC 27001 compliant information security management system.
BSI's page itself is slightly inconsistent about the Part 1 version, since its document list also shows 0.10.0. Check the PDF you download.
What Part 2 adds
BSI's page says version 2.1.0 adds a recommended mapping between its data fields and the SPDX and CycloneDX formats, revises the licence section, and introduces virtual and referenced components. BSI also registered a CycloneDX namespace and published its taxonomy on its GitHub account to help teams produce SBOMs that follow Part 2.
The page does not list the individual data fields, so read the PDF for those. CISA's 2026 minimum elements document names BSI TR-03183-2 as one of the national references for SBOM technical requirements.
Status next to the CRA
BSI says the guideline is meant to help manufacturers prepare for the CRA, especially those with less mature security processes. It will be developed further and replaced by harmonized European standards when they exist. The CRA applies in full from 11 December 2027.
So a team that follows Part 2 is not automatically compliant. It has followed one authority's reading of the technical details. A market surveillance body is not bound to accept it as proof.
Who should read it
- Manufacturers selling into Germany who want a concrete field list and format mapping now.
- Buyers in German regulated sectors who may cite it in a questionnaire.
- Tool builders who need a target for SBOM output.
Practical use
- Map your current SBOM output to Part 2 and list the gaps.
- Use the SPDX or CycloneDX mapping rather than inventing field names.
- Record the version of the guideline you used, as it changes.
- Compare it with the CISA 2026 elements. The two overlap in spirit, and a single SBOM can often serve both.
For the EU law itself, see what the CRA says about SBOMs.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through the mapping view and notice how a single piece of evidence can serve more than one framework.
Quick check
Is TR-03183 mandatory?
BSI describes it as a guide that is not binding and cannot be used as a presumption of conformity.
Which formats does Part 2 name?
SPDX and CycloneDX, with a recommended mapping between those and its data fields.
Sources
Last reviewed: 19 October 2026.
