The EU is the clearest case of a legal SBOM duty, through the Cyber Resilience Act. The US now leaves it to each agency, Germany's BSI offers non-binding technical guidance, and India's CERT-In encourages SBOMs in procurement. All four converge on machine-readable SBOMs in SPDX or CycloneDX.
The four at a glance
United States. Documents: OMB M-26-05 and the CISA 2026 minimum elements. Legal weight: agencies may choose an SBOM on request term, and the CISA elements are guidance. Addressed to: federal agencies, through their contracts. Depth: no minimum depth, and transitive dependencies are included. Formats: SPDX and CycloneDX are named. Release: distribution to those who need it.
European Union. Document: Regulation (EU) 2024/2847, the CRA. Legal weight: binding on manufacturers, applying from 11 December 2027. Addressed to: manufacturers of products with digital elements. Depth: top-level dependencies at the very least. Formats: commonly used and machine-readable. Release: manufacturers are not obliged to make it public.
Germany. Document: BSI TR-03183 Part 2. Legal weight: described by BSI as a guide, not binding. Addressed to: manufacturers preparing for the CRA. Formats: SPDX and CycloneDX, with a recommended field mapping. Depth and release rules: see the PDF.
India. Document: CERT-In guidelines version 2.0 of 9 July 2025. Legal weight: a technical guideline that encourages mandatory practice. Addressed to: government, public sector, essential services and exporters. Depth: dependency fields are listed. Formats: SPDX and CycloneDX are named. Release: the document has a chapter on access control and sharing.
Reading across the columns
Legal weight differs most. Only the CRA places a duty on manufacturers by law. The US memo rescinded a government-wide attestation approach in January 2026 and left SBOMs as one option for agencies. Germany and India give technical advice.
The technical fields converge. The 2026 CISA document was authored with partners including BSI, CERT-In, Japan's METI and others, 18 organizations in all, counting CISA, by its own list. It names the CRA, BSI TR-03183-2, CERT-In's guidelines and METI's guidance on SBOM introduction as part of the international picture. So an SBOM built to the CISA 2026 elements will map well to the others, though field names differ.
The minimum is not the target. The CRA's top-level floor is lower than what CISA says a useful SBOM contains. A manufacturer serving several markets will usually build to the fuller standard.
Building one SBOM for several regimes
- Start from the CISA 2026 elements, since they are the most detailed and widely co-signed.
- Add the BSI mapping if you sell in Germany.
- Check CERT-In's extra fields, such as end of life date and criticality, if you sell to Indian public sector buyers.
- Keep a short note recording the document and version each customer cited.
- Check the contract. A table like this cannot replace the clause you signed.
Details on each: what the CRA says about SBOMs, BSI TR-03183, and India's CERT-In guidelines.
I did not confirm the current text of Japan's METI guidance, so it is not in the table.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through the mapping and look for duties that appear under more than one framework.
Quick check
Which region has a binding SBOM duty?
The EU, through Annex I of the CRA, from 11 December 2027. The other three are agency choices or guidance.
Can one SBOM serve all four?
Often mostly, if built to the CISA 2026 elements with extra fields added, but check each buyer's wording.
Sources
- CISA 2026 Minimum Elements for an SBOM
- OMB M-26-05
- Regulation (EU) 2024/2847 on EUR-Lex
- BSI TR-03183 page
- CERT-In SBOM guidelines v2.0
Last reviewed: 19 October 2026.
