What Is Inside a Smartphone: A BOM Read From an Environmental Report

A smartphone Product Environmental Report tells you what the phone is made of by material, how much of that material is recycled, what battery chemistry it uses, how the packaging is built and how much carbon the device is estimated to cost over its life. It does not tell you which parts are inside, who made them, where they were made or what firmware they run. It is a materials report, not a parts list, and reading it well means knowing exactly where that line falls.

This guide reads two real vendor reports line by line: Apple's iPhone 18 Pro and iPhone 18 Pro Max report, dated to the 9 September 2026 launch, and Google's Pixel 9 Pro report from August 2024, which is the newest Pixel report we could retrieve directly and the one that publishes a gram by gram material breakdown. It then follows each material line down to the components and minerals behind it, checks both companies' 2026 conflict minerals filings with the US Securities and Exchange Commission, and shows how the same phone would look as a hardware bill of materials (HBOM) in CycloneDX and how its firmware and operating system would appear in a software bill of materials (SBOM). It goes one level deeper than our guide to how a smartphone is made, which covers the factory side.

Key takeaways

• A Product Environmental Report (PER) is a life cycle and materials disclosure. Apple's iPhone 18 Pro report gives recycled content (40 percent of device mass), a carbon footprint per storage configuration (63 kg CO2e gross for the 256 GB iPhone 18 Pro) and named recycled materials by component, but no mass by material table.
• Google's Pixel 9 Pro report does give mass by material: 199 g in total, of which the battery is 59 g, aluminium 32 g, the display 24 g, electronics 22 g, steel 16 g, glass 15 g, plastic 13 g and other materials 18 g.
• Under the EU smartphone ecodesign rules, Google also publishes indicative weight ranges for critical raw materials in the Pixel 9 Pro: 2 to 10 g of cobalt in the battery, less than 0.01 g of tantalum in capacitors, more than 0.2 g of neodymium in magnets and less than 0.02 g of gold across all components.
• Conflict minerals (tin, tantalum, tungsten and gold, or 3TG) are reported separately on SEC Form SD. Apple's filing for calendar 2025 relies on a 2017 SEC staff statement and attaches no Conflict Minerals Report; Alphabet's attaches one listing 292 smelters and refiners across its hardware.
• An HBOM adds what an environmental report cannot: manufacturer part numbers, component versions, firmware providers, assembly and test locations and hashes. The CISA HBOM Framework (25 September 2023) defines those fields; CycloneDX 1.7 (released 21 October 2025) can carry them with device and firmware component types.
• The software on the phone, from boot ROM and bootloader to baseband firmware, kernel and apps, belongs in an SBOM. Android's build system can generate one in SPDX 2.3 format with a single build target.

What a Product Environmental Report contains, and what it does not

A Product Environmental Report is a short public document, usually four to seven pages, that a device maker publishes for each model. The format is not set by any single standard, but the content clusters around the same themes because the same regulations and life cycle standards drive it: ISO 14040, ISO 14044 and ISO 14067 for carbon footprints, ISO 14021 for recycled content claims, the US Department of Energy test method for battery chargers for energy efficiency, and since June 2025 the EU ecodesign rules for smartphones.

Both reports in this guide say they apply to a specific configuration. Apple's says its evaluations are "based on U.S. configuration" of the two phones, and Google's gives its carbon figure for the 128 GB Pixel 9 Pro. That detail matters: storage capacity changes the carbon number sharply, as you will see below.

Apple's report even names the gap. It says Apple runs a "Full Material Disclosure (FMD) program" that "allows us to collect material and chemical data deep into our supply chain." In other words, the detailed per part material data exists inside the company, and the PER is the public summary of it.

How do you read Apple's iPhone 18 Pro report line by line?

Apple's iPhone 18 Pro and iPhone 18 Pro Max Product Environmental Report is six pages. The cover gives the date introduced, 9 September 2026, and three headline numbers. The rest breaks into carbon, materials, product insights, definitions and endnotes. Here is every substantive line, what it means and what it does not say.

The headline numbers

For comparison, Apple's iPhone 17 Pro report from September 2025 gave 30 percent recycled content, 40 percent of manufacturing electricity from supplier renewable energy projects, and 50 percent recycled aluminium in the enclosure. The 2025 report is now marked as archived on Apple's site.

The carbon footprint

The report gives the 256 GB iPhone 18 Pro a figure of 63 kg CO2e gross greenhouse gas emissions, split by life cycle phase:

The shares are our arithmetic from Apple's numbers and do not add exactly to 100 because of rounding. Production totals 46 kg, so roughly three quarters of the phone's life cycle carbon is spent before it reaches a customer. Apple assumes three years of use for iPhone.

The configuration table is where storage shows up:

Worked example. Going from the 256 GB iPhone 18 Pro to the 2 TB model adds 109 minus 63, or 46 kg CO2e, which is a 73 percent increase for the same body, screen and battery. The difference is almost entirely the extra flash memory dies and the energy needed to make them. A materials report cannot tell you how many NAND dies are in each configuration, but the carbon table gives you the effect of adding them.

One reading trap: the iPhone 17 Pro report labels its 64 kg figure for the 256 GB model as "Net GHG", while the iPhone 18 Pro report labels its 63 kg as gross emissions. Read the definitions before you treat the two numbers as a trend line.

The report also explains a methodology change. In fiscal 2026 Apple updated its life cycle models for display panels and for the system on chip. The display model now uses average carbon intensities of 0.16 kg CO2e per square centimetre for OLED and 0.03 kg CO2e per square centimetre for LCD. For the system on chip, Apple says it uses imec.netzero models from imec's Sustainable Semiconductor Technologies and Systems programme, with primary data for CMOS logic nodes including effective die size, regional electricity grid and supplier abatement.

Worked example. Apple does not publish the panel area, so assume for illustration a flat 6.3 inch class OLED panel with an active area of roughly 7 cm by 15 cm, or about 105 square centimetres. At 0.16 kg CO2e per square centimetre that is roughly 17 kg CO2e for the panel alone. That is an assumption-driven estimate, not an Apple figure, but it shows why the display and the chip are the two places Apple chose to refine first: a single large component can carry a sizeable share of a 46 kg production footprint.

The recycled materials grid

This is the closest the report gets to a materials list. Each tile names a material, a recycled share and a location in the phone:

Two things stand out. First, the grid covers every conflict mineral except tantalum: tin (solder), tungsten (Taptic Engine) and gold (plating and wire) all appear with a recycled claim. Second, the qualifiers are precise and you should keep them. "All Apple designed printed circuit boards" is narrower than "all circuit boards", and a camera module from a supplier may carry its own boards.

Product insights and packaging

The third page covers water (a supplier clean water programme targeting a 50 percent average water reuse rate by 2030), safer cleaners at final assembly sites, smarter chemistry (the Regulated Substances Specification and the FMD programme), energy efficiency, longevity, zero waste and supply chain labour standards. The material facts here are:

• Packaging. "100 percent fiber-based" and made only from recycled or responsibly sourced fibres. Endnote 4 adds that the breakdown is for US retail packaging by weight and excludes adhesives, inks and coatings. Unlike older Apple reports, this one gives no gram figures for the packaging.
• Glass. The front cover is Ceramic Shield 2, which Apple says has three times better scratch resistance than the previous generation. That is a durability claim, not a material disclosure, and the report does not give the glass chemistry.
• Energy efficiency. The phone and charger use 60 percent less energy than the US Department of Energy federal standard for battery chargers. The 20 W USB-C power adapter draws 0.04 W with no load, and averages 87.4 percent, 88.0 percent and 87.8 percent efficiency at 100 V, 115 V and 230 V.
• Zero waste. Endnote 5 says all established final assembly sites for these phones are third party verified as Zero Waste by UL under the UL 2799 standard, which requires at least 90 percent diversion through methods other than waste to energy.

What is missing is as instructive as what is there. The report names no battery capacity, no cell supplier, no assembly country and no chip. You can read it cover to cover and still not know that the phone has a modem, a camera sensor or a memory package, except by inference from the carbon methodology.

What does a gram by gram material breakdown look like?

Google's Pixel 9 Pro report, for model GR83Y introduced in August 2024, is seven pages and includes a "Material use" chart that Apple's report does not. Endnote 11 says the masses are for the phone only, excluding packaging and accessories, and that the US configuration adds 27 g of electronic accessories in the box.

The shares are our arithmetic and do not add exactly to 100 because of rounding. The contents column is our interpretation of typical phone construction. The labels mix material classes (aluminium, steel, glass, plastic) with subassemblies (battery, display, electronics), which is common in these charts and important to notice. "Electronics" is not a material, and its 22 g contains copper, gold, tin, tantalum, silicon, ceramics, epoxy and many other substances.

Worked example. The battery is 59 g. Google's own EU disclosure (below) puts cobalt in the battery at between 2 g and 10 g. That means cobalt is somewhere between 3.4 percent (2 divided by 59) and 17 percent (10 divided by 59) of the battery's mass, and between 1.0 percent and 5.0 percent of the whole phone. A wide range, but a real bound you can use for recycling estimates or due diligence scoping.

The recycled materials section gives five claims, each with an endnote that sets its scope:

• At least 18 percent recycled materials based on product weight (endnote 18).
• The aluminium in the housing is 100 percent recycled content; recycled aluminium is at least 12 percent of product weight (endnote 12). On 199 g that is about 24 g or more, which fits inside the 32 g aluminium line.
• The haptics engine magnets use 100 percent recycled rare earth elements, which are at least 27 percent of the magnet's total weight (endnote 13). The rest of the magnet is mostly iron and boron, which is why "100 percent recycled rare earths" and "27 percent of the magnet" are both true.
• 100 percent recycled tin in the solder of all Google designed rigid and flexible printed circuit boards; the solder paste contains at least 80 percent tin (endnote 14).
• Ten of the 15 plastic components contain at least 63 percent recycled plastic, accounting for at least 0.7 percent of product weight (endnote 15). Endnote 2 separately says about 68 percent recycled content across plastic parts, excluding plastics in boards, cables, connectors, electronic modules, films, coatings and adhesives.

The battery line says only "Lithium-ion polymer". The report also lists PVC-free and brominated flame retardant free status, UL ECOLOGO Gold certification (registered in the US only), 100 percent plastic-free retail packaging, a carbon footprint of 72 kg CO2e over three years of use for the 128 GB model (82 percent production, 3 percent transportation, 14 percent customer use, 1 percent recycling), and standby power of 0.17 W at 115 V and 0.19 W at 230 V.

The EU critical raw materials disclosure

The most useful single paragraph in the Pixel report is endnote 18, added "in accordance with European Union's Ecodesign of Smartphones 2023/1670 requirements." It gives indicative weight ranges for four critical raw materials:

The same endnote reports a recyclability rate of 69.35 percent and a recoverability rate of 78.65 percent, evaluated by an independent testing company using EN 45555:2019.

Worked example. Gold is under 0.02 g per phone. Multiply by one million phones and the upper bound is 20 kg of gold. USGS estimates world gold mine production at about 3,300 tonnes in 2025, so a million phones at the upper bound account for less than one thousandth of one percent of a year's mined gold. The tiny per unit mass is why gold in phones is a traceability and labour question more than a tonnage question.

Which components and minerals sit behind each material line?

Every line in a PER rolls up something with its own mining and refining chain. The table below maps the lines in both reports to components and minerals, with supply context from the US Geological Survey's Mineral Commodity Summaries 2026.

A few points are worth drawing out.

Rare earths. Apple says 100 percent of the rare earth elements in all magnets on the iPhone 18 Pro are recycled, and Google says the same for the Pixel 9 Pro's haptics magnets only. Those are different scopes, and "all magnets" versus "haptics magnets" is the kind of difference a reader has to catch. In an HBOM, each of those magnets sits inside a named subassembly, which is where our complete HBOM guide starts.

Cobalt and lithium. Both vendors put recycled claims on the battery, but neither publishes the cathode chemistry by formula. "Lithium-ion polymer" describes the cell format and electrolyte, not whether the cathode is lithium cobalt oxide or a nickel-rich blend. Our lithium-ion battery production guide walks the cell from mine to pack.

Silicon. Neither report has a "silicon" line. The chips are inside "Electronics" for Google and inside the carbon model for Apple. By mass, the silicon in a phone is tiny; by carbon and by supply chain complexity, it is large. Our semiconductor manufacturing guide covers that chain.

Conflict minerals reporting: what do the vendors' own SEC filings say?

In the United States, conflict minerals reporting is separate from environmental reporting. Rule 13p-1 under the Securities Exchange Act requires companies that manufacture products containing tin, tantalum, tungsten or gold to file Form SD each year, covering the calendar year. Alphabet's report quotes the statutory definition: columbite-tantalite (coltan), cassiterite, gold and wolframite, or their derivatives, limited to tin, tantalum, tungsten and gold. The "Covered Countries" are the Democratic Republic of the Congo and its adjoining countries.

Apple's Form SD for calendar 2025

Apple filed its Form SD on 28 May 2026 for the period 1 January to 31 December 2025. The filing says Apple is relying on the "Updated Statement on the Effect of the Court of Appeals Decision on the Conflict Minerals Rule" issued by the SEC's Division of Corporation Finance on 7 April 2017, and as that statement permits, Apple provides Item 1.01 disclosure but does not file a Conflict Minerals Report. Item 1.02 and Item 3.01 both say no exhibit is filed.

What the filing does say:

• Apple does not directly purchase minerals from mine sites, but its responsible minerals programme applies requirements at all levels of the supply chain, aligned with the OECD Due Diligence Guidance (2016) and the UN Guiding Principles on Business and Human Rights.
• One hundred percent of identified 3TG smelters and refiners in Apple's supply chain are required to participate in an independent third party audit annually, and Apple says it acts through suppliers to end relationships with those that cannot or will not meet its standards.
• Apple's reasonable country of origin inquiry required suppliers that use 3TG to submit the industry standard Conflict Minerals Reporting Template (CMRT), across iPhone, Mac, iPad, AirPods, Apple TV, Apple Watch, Apple Vision Pro, Beats, HomePod, Apple Card and accessories.
• Apple found "no reasonable basis for concluding" that any identified smelter or refiner, as of 31 December 2025, directly or indirectly financed or benefited armed groups in the Covered Countries.
• Apple believes 3TG in its products "may have originated" from the Covered Countries, and also came from recycled and scrap sources. It notes that smelters report origin in aggregate across all customers, so Apple cannot always determine the origin of the 3TG in specific parts.

Alphabet's Form SD for calendar 2025

Alphabet's Form SD is dated 29 May 2026 and appears on EDGAR with a filing date of 1 June 2026. Unlike Apple, Alphabet attaches a full Conflict Minerals Report as Exhibit 1.01. It covers all in-scope Alphabet hardware, which it lists as consumer devices such as phones, home devices, wearables, streaming devices, tablets, security cameras and healthcare technology, so it is not a Pixel only report. Key facts:

• Alphabet says it does not directly purchase raw materials and is several tiers away from the smelter.
• It uses the RMI Conflict Minerals Reporting Template, the Extended Minerals Reporting Template and the Additional Minerals Reporting Template for specific suppliers.
• It reports a 100 percent response rate from in-scope suppliers for 2025.
• It follows the five step OECD framework and, for the ninth consecutive year, used an independent third party to assess 100 percent of smelters its suppliers disclosed.

Of the 292, Alphabet says 209 are RMI "conformant" and 7 are "active" in the assurance process, and a further 74 were identified as not sourcing from the Covered Countries. The remaining two have a "non-conformant" status, and Alphabet says suppliers asked for more time to stop using them.

What the two filings tell you when read together

The two companies file under the same rule and reach their conclusions with the same industry template, but the public detail is very different. Apple's 2026 filing gives a programme description and a conclusion; Alphabet's gives counts by metal and status. Neither names a single smelter in the filing itself, and neither ties a smelter to a phone model. That is the structural limit of conflict minerals reporting: it is company wide and metal level, not device and part level.

In the EU, the equivalent obligation sits with importers rather than device makers. Regulation (EU) 2017/821 was passed in May 2017 and its requirements began to apply on 1 January 2021. It requires EU importers of 3TG minerals and metals to source responsibly, and the Commission runs a voluntary transparency platform called ReMIS.

How do the two vendors' reports compare?

This is a comparison of what each report discloses, by criterion. It is not a ranking of the phones or the companies, and the devices are from different years.

Two cautions. The carbon figures are for different storage sizes and different years with different models, so they are not comparable without normalising. And "recycled content" is defined by each company: Apple's endnote defines it as certified recycled material mass over device mass, Google's as recycled materials based on product weight, each with its own exclusions.

How would the same phone look as an HBOM in CycloneDX?

A hardware bill of materials lists the parts, not the materials. CISA's HBOM Framework for Supply Chain Risk Management, published on 25 September 2023, gives three reasons a buyer might ask for one: compliance (government rules such as FY2019 NDAA Section 889, UFLPA and withhold release orders, plus industry and internal requirements), security (exposure to untrusted or counterfeit parts and to known vulnerabilities) and availability (world events and supply concentration). It then defines a taxonomy of data fields and maps each to CycloneDX and SPDX where an equivalent exists.

The field mapping is revealing:

Many fields have no direct CycloneDX equivalent in CISA's 2023 mapping, so in practice HBOM producers carry them as CycloneDX properties with a namespaced name. The framework also notes that it records the provider of a component's firmware but "stops short" of a framework for firmware provenance, and that SBOM information is out of its scope.

CycloneDX itself is now at version 1.7, released on 21 October 2025, and is standardised by Ecma International as ECMA-424 through Technical Committee TC54; the CycloneDX site lists the current ECMA-424 edition as published on 10 December 2025. Its component type list includes device ("a hardware device such as a processor or chip-set") and firmware ("a special type of software that provides low-level control over a device's hardware"). The specification adds that a hardware device containing firmware "SHOULD include a component for the physical hardware itself and another component of type 'firmware' or 'operating-system'".

Here is a minimal HBOM for a hypothetical phone, built with that pattern. Every part number, version and location below is a placeholder, because no vendor publishes these for a flagship phone, and that absence is the point of this section.

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
  "version": 1,
  "metadata": {
    "timestamp": "2026-10-24T00:00:00Z",
    "component": {
      "type": "device",
      "bom-ref": "phone",
      "name": "Example Phone Pro",
      "version": "HW-REV-B",
      "manufacturer": { "name": "Example Device Co" },
      "properties": [
        { "name": "hbom:finished_good:model", "value": "EXAMPLE-1234" },
        { "name": "per:recycled_content_pct", "value": "40" },
        { "name": "per:report_url", "value": "https://example.com/per.pdf" }
      ]
    }
  },
  "components": [
    {
      "type": "device",
      "bom-ref": "soc",
      "name": "EXAMPLE-SOC-X1",
      "version": "B0",
      "supplier": { "name": "Example Silicon" },
      "properties": [
        { "name": "cisa:hbom:COMP_PART_TYPE", "value": "Semiconductor" },
        { "name": "cisa:hbom:ASSY_AND_TEST_LOC_CODE", "value": "XX-YY" }
      ]
    },
    {
      "type": "firmware",
      "bom-ref": "soc-bootrom",
      "name": "soc-boot-rom",
      "version": "mask-rev-2",
      "supplier": { "name": "Example Silicon" }
    },
    {
      "type": "device",
      "bom-ref": "modem",
      "name": "EXAMPLE-MODEM-M5",
      "version": "A1",
      "supplier": { "name": "Example Radio" }
    },
    {
      "type": "firmware",
      "bom-ref": "modem-fw",
      "name": "baseband",
      "version": "5.12.03",
      "supplier": { "name": "Example Radio" }
    },
    {
      "type": "device",
      "bom-ref": "battery",
      "name": "EXAMPLE-CELL-4500",
      "version": "1",
      "properties": [
        { "name": "cisa:hbom:COMP_PART_TYPE", "value": "Battery" },
        { "name": "material:chemistry", "value": "Lithium-ion polymer" },
        { "name": "eu:crm:cobalt_g_range", "value": "2-10" }
      ]
    },
    {
      "type": "device",
      "bom-ref": "cap-c101",
      "name": "EXAMPLE-TA-CAP-10UF",
      "version": "1",
      "properties": [
        { "name": "cisa:hbom:COMP_DESCRIPTION", "value": "10UF tantalum capacitor" },
        { "name": "conflict_mineral", "value": "tantalum" }
      ]
    },
    {
      "type": "operating-system",
      "bom-ref": "os",
      "name": "example-os",
      "version": "26.1"
    }
  ],
  "dependencies": [
    { "ref": "phone", "dependsOn": ["soc", "modem", "battery", "cap-c101", "os"] },
    { "ref": "soc", "dependsOn": ["soc-bootrom"] },
    { "ref": "modem", "dependsOn": ["modem-fw"] }
  ]
}

The specVersion is set to 1.6 because more validators and tools support it today; the same structure is valid under 1.7. Our step by step guide to creating an HBOM in CycloneDX goes further on nesting assemblies, and HBOM versus SBOM explains where to draw the boundary between the two.

Notice how the environmental report data fits: as properties on the finished good and on the battery. The PER is a useful annotation on an HBOM, but it cannot generate one.

What does an HBOM add that an environmental report cannot?

Put the three documents side by side and the division of labour becomes clear.

The three added capabilities that matter most for security are part numbers, firmware versions and origin. Part numbers let you match a component to a manufacturer's security advisory or end of life notice. Firmware versions let you match a component to a fixed release. Origin fields let you answer procurement rules that name countries or entities. None of them can be recovered from a materials report, no matter how carefully you read it.

How do the phone's firmware and OS components appear in an SBOM?

The HBOM stops at "this modem runs baseband firmware 5.12.03". The SBOM is where that firmware, and everything above it, is broken into components.

Apple's Platform Security guide describes the iPhone boot chain, which is a good map of the firmware layers on any modern phone. When the device turns on, the application processor runs code from read-only memory called the Boot ROM, which Apple calls the hardware root of trust; it is laid down during chip fabrication and contains the Apple Root certificate authority public key used to verify that the iBoot bootloader is signed by Apple. iBoot then verifies and runs the kernel. On devices with an A9 or earlier processor, a Low-Level Bootloader stage sits between them. Apple says this secure boot chain covers the bootloaders, the kernel, kernel extensions and cellular baseband firmware.

Turned into an SBOM view, a phone's software stack looks like this:

Android is the clearest public example of SBOM generation at OS level. The Android Open Source Project documentation says SBOMs are generated automatically for Android continuous integration builds, that they are compatible with SPDX 2.3, that they follow the NTIA minimum elements, and that you can build one for a custom target with m sbom. A device maker building Android for a phone starts from that SBOM and adds its own vendor partitions, which carry the firmware blobs listed above.

For the layers a device maker does not build, an SBOM can still record the component, its supplier and its version, even if the contents are opaque. That is the same pattern CycloneDX uses for hardware: name the thing precisely enough to match it against an advisory later.

Step by step: build your own phone inventory from public and on-device data

The steps below collect what is public (the PER and Form SD), what is visible on the device (firmware and OS versions) and combine them into a CycloneDX file. They work on macOS or Linux with common tools.

Step 1: Download and extract the environmental report

mkdir -p ~/phone-bom && cd ~/phone-bom
curl -sLo per.pdf "https://www.apple.com/environment/pdf/products/iphone/iPhone_18_Pro_and_iPhone_18_Pro_Max_PER_Sept2026.pdf"
pdftotext -layout per.pdf per.txt

# Pull every recycled content claim and the carbon table
grep -nE "recycled|kg|GB|TB" per.txt | head -60

For the Pixel report, swap in Google's URL. Charts drawn as graphics can scramble in text extraction, so if the numbers come out in an odd order, render the page and read it:

pdftoppm -f 4 -l 4 -r 100 -png per.pdf page

Step 2: Pull the vendor's conflict minerals filing from EDGAR

The SEC asks automated clients to send a descriptive User-Agent with a contact address.

UA="Your Name your.address@example.com"
# Apple CIK 320193, Alphabet CIK 1652044
curl -s -A "$UA" https://data.sec.gov/submissions/CIK0000320193.json -o apple.json
python3 - <<'EOF'
import json
r = json.load(open("apple.json"))["filings"]["recent"]
for form, date, acc, doc in zip(r["form"], r["filingDate"], r["accessionNumber"], r["primaryDocument"]):
    if form.startswith("SD"):
        print(form, date, acc, doc)
EOF

Each line gives an accession number. The filing index lives at https://www.sec.gov/Archives/edgar/data/<CIK>/<accession without dashes>/, and Exhibit 1.01, when present, is the Conflict Minerals Report.

Step 3: Read the firmware and OS versions from the phone

On an Android phone with USB debugging turned on in developer options:

adb devices
adb shell getprop ro.product.model
adb shell getprop ro.build.fingerprint
adb shell getprop ro.build.version.release
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.bootloader
adb shell getprop gsm.version.baseband

On an iPhone connected to a Mac or Linux machine with the open source libimobiledevice tools installed and the device trusted:

ideviceinfo -k ProductType
ideviceinfo -k ProductVersion
ideviceinfo -k BuildVersion
ideviceinfo -k BasebandVersion
ideviceinfo -k FirmwareVersion

These are read-only queries and change nothing on the device. They give you the OS release, the build, the security patch level on Android, the bootloader version and the baseband firmware version, which are exactly the version fields an environmental report never carries.

Step 4: Write the CycloneDX file

Start from the JSON template above. Put the PER facts in properties on the finished good, record the firmware versions you read in Step 3 as firmware components, and add the OS as an operating-system component. Keep each placeholder clearly marked until you have a real value from the vendor.

Step 5: Validate it

With the CycloneDX command line tool installed:

cyclonedx validate --input-file phone-hbom.cdx.json --input-format json --input-version v1_6 --fail-on-errors

Check the validate command's help output for the specification versions your build supports before switching to 1.7.

Step 6: Generate the OS SBOM for an Android build you control

If you build Android for a device, the AOSP documentation gives the exact sequence:

source build/envsetup.sh
lunch aosp_arm64-userdebug
m sbom
ls out/dist/sbom*

Replace the lunch target with your own device target. The output is an SPDX 2.3 document for the build.

Step 7: Scan the software you ship alongside the phone

The companion app, the backend it talks to and the container images behind it are all software you build. If you use Safeguard, scan them from the CLI:

safeguard scan --dir .
safeguard scan --image registry.example.com/device-cloud/api:3.2
safeguard scan --sbom ./companion-app-sbom.cdx.json

Results are written as JSON under ./output, and the platform shows which projects contain a given component and version.

A dated timeline of the documents in this guide

What EU rules now ask phone makers to disclose

The EU's smartphone ecodesign and energy labelling rules apply to smartphones placed on the EU market from 20 June 2025. According to the European Commission, they require resistance to drops, scratches, dust and water; batteries that withstand at least 800 charge cycles while keeping at least 80 percent of initial capacity; critical spare parts available within 5 to 10 working days for 7 years after a model's end of sales; operating system upgrades for at least 5 years after the last unit is placed on the market; and non-discriminatory access for professional repairers to software or firmware needed for replacement. The energy label is also the first in the EU to carry a repairability class.

Two of those points touch software directly. A 5 year minimum for operating system upgrades means the OS and its open source components have to be maintained and rebuilt for at least that long after sales end. And access to "software or firmware needed for the replacement" means firmware that pairs or calibrates a replaced part is now in scope of a product regulation.

The EU Batteries Regulation (EU) 2023/1542 entered into force on 17 August 2023 and covers portable batteries among five categories, with requirements for sustainability, safety, labelling, supply chain due diligence and end of life. Article 11 sets removability and replaceability requirements for portable batteries in products, with derogations in Article 11(2), and the Commission has published guidelines on applying them. As those provisions take effect, future environmental reports and HBOMs are likely to carry more battery detail than today's.

Firmware, software and why they are a supply chain

Everything above the Boot ROM on a phone is software that someone builds, and almost all of it contains open source components: the kernel, compression and image libraries, networking stacks, cryptographic libraries, Bluetooth and Wi-Fi stacks, and the frameworks inside every app. The OS update obligations in the EU rules, and the patch levels you read in Step 3, are what that software supply chain looks like from the outside.

For anyone who sells hardware with software around it, three practices hold regardless of company size:

1. Keep an SBOM for every build you ship, not just every product. A phone model may ship dozens of OS builds over its supported life.
2. Record firmware versions in your hardware inventory. CISA's COMP_VERSION field exists for this. If you only record part numbers, you cannot answer "which units still run the old modem firmware?"
3. Link the documents. Put the PER URL, the Form SD accession number and the SBOM reference on the finished good in your HBOM, so the materials, minerals and software views of the same device can be found from one place.

Our complete HBOM guide covers how to keep those records current.

Where Safeguard fits, honestly

Safeguard does not read environmental reports, track minerals, audit smelters, scan firmware binaries or generate hardware bills of materials, and its models are single purpose security models, not materials or chemistry tools. The fit is with the software around the phone: the companion apps, device cloud services, update servers and container images that device makers and app teams build. For those, Safeguard scans repositories, container images and SBOM files, matches components against vulnerability data, shows which projects contain a given component and version, ranks findings with reachability analysis, evaluates policies and gates, and can open fix pull requests through autonomous remediation, which ships switched off by default.

Common mistakes

• Treating a PER as a parts list. It lists materials and claims. It will not tell you which capacitor, modem or memory part is inside.
• Converting percentages to grams without a mass. Apple's report gives 40 percent recycled content but no device mass, so any gram figure you derive from it rests on an outside assumption.
• Dropping the qualifiers. "All Apple designed printed circuit boards", "haptics engine magnets" and "in the enclosure" each narrow a claim. Copying the percentage without the scope changes its meaning.
• Comparing carbon numbers across configurations or methods. The 256 GB and 2 TB iPhone 18 Pro differ by 46 kg CO2e, and Apple changed its display and chip models in fiscal 2026. Compare like with like.
• Reading "Electronics" as a material. In Google's chart it is a subassembly class holding many metals, including all four conflict minerals.
• Assuming the conflict minerals filing is device specific. Both companies report across all their hardware. Neither ties a smelter to a phone model.
• Assuming every Form SD has a Conflict Minerals Report. Apple's 2026 filing relies on the 2017 SEC staff statement and attaches none.
• Leaving firmware out of the HBOM. CycloneDX explicitly recommends a separate firmware or operating-system component for any device that runs code.
• Using one SBOM for the life of a phone model. Every OS and security update is a new build with new component versions.

FAQ

What is a Product Environmental Report?

It is a short document a device maker publishes for each model, summarising its life cycle carbon footprint, recycled and renewable materials, battery type, packaging, restricted substances and energy efficiency. It is based on life cycle assessment standards such as ISO 14040, ISO 14044 and ISO 14067, and on the company's own material disclosure programme.

How much does a smartphone weigh by material?

Google's Pixel 9 Pro report gives 199 g in total: battery 59 g, aluminium 32 g, display 24 g, electronics 22 g, steel 16 g, glass 15 g, plastic 13 g and other 18 g. Apple's iPhone 18 Pro report does not publish mass by material.

How much gold is in a smartphone?

Very little. Google's Pixel 9 Pro report, following the EU ecodesign rules, puts gold across all components at less than 0.02 g. It sits in contact plating and in bond wires inside chip and camera packages.

How much cobalt is in a phone battery?

For the Pixel 9 Pro, Google gives an indicative range of 2 g to 10 g of cobalt in the battery. Apple does not give a mass for the iPhone 18 Pro, but says the battery uses 100 percent recycled cobalt.

What are conflict minerals in phones?

Tin, tantalum, tungsten and gold, often called 3TG. Tin is in solder, tantalum in capacitors, tungsten in the vibration motor mass and gold in plating and bond wires. US companies report on them each year on SEC Form SD.

Does Apple file a Conflict Minerals Report?

Not in its 2026 filing. Apple's Form SD for calendar 2025, filed on 28 May 2026, relies on the SEC staff statement of 7 April 2017 and provides Item 1.01 disclosure without a Conflict Minerals Report or exhibit.

What is the difference between a PER and an HBOM?

A PER describes what the device is made of and its environmental impact. An HBOM lists the components themselves, with manufacturer part numbers, versions, suppliers and locations, so you can check them against advisories, procurement rules and end of life notices.

Can CycloneDX describe a smartphone?

Yes. CycloneDX has a device component type for hardware and a firmware type for low-level software, and the specification recommends pairing each device that runs code with a firmware or operating system component. Fields CycloneDX lacks can be carried as properties.

Where does phone firmware go in an SBOM?

Each firmware image, such as the bootloader, secure processor firmware, baseband and Wi-Fi firmware, becomes a firmware component with its supplier and version. The kernel and OS become an operating-system component with library components beneath it.

Can I see my phone's firmware versions?

Yes. On Android, adb shell getprop reports the build fingerprint, security patch level, bootloader and baseband versions. On iPhone, the libimobiledevice ideviceinfo tool reports the OS version, build and baseband version from a connected, trusted device.

Why supply chain hygiene still matters here

The aluminium, cobalt and gold in a phone carry no software dependencies, but almost everything that runs on the phone does, from the Android or iOS userspace to the companion app and the cloud services it calls. The EU now requires at least five years of OS updates after a model leaves the market, so the open source components inside that software have to be patched and rebuilt for years, and the section below applies to that software layer, not to the materials.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

The first demo is a real Safeguard CLI session. Asked to fix a lodash CVE, it reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with approval, prints a summary and pushes nothing. The same approve each step flow fits a dependency upgrade in a phone's companion app, a device registration service or an update server.

Click through it at your own pace, or open it full screen.

The second demo is a real Android session with the Safeguard mobile app. It sends work to a computer running the CLI and approves the command on the phone with Allow once, Allow for turn or Deny. For a device team, that means the engineer holding the test phone can also approve the dependency fix running on the build machine, without the phone itself doing the scanning.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and chooses which tools Claude can use. A product security lead can then ask which apps and services around a device line still contain a vulnerable component version, with access limited to the tools the team allowed.

Click through it at your own pace, or open it full screen.

To try it on your own code, download Safeguard or read the CLI documentation.

Quick check

Sources

• Apple: Environment, product reports and library
• Apple: iPhone 18 Pro and iPhone 18 Pro Max Product Environmental Report, September 2026 (PDF)
• Apple: iPhone 17 Pro and iPhone 17 Pro Max Product Environmental Report, September 2025 (PDF)
• Apple: iPhone 11 Product Environmental Report, September 2019 (PDF)
• Google: Pixel 9 Pro Product Environmental Report (PDF)
• Apple Inc. Form SD for the period 1 January to 31 December 2025, filed 28 May 2026 (SEC EDGAR)
• Alphabet Inc. Form SD for calendar 2025 (SEC EDGAR)
• Alphabet Inc. Conflict Minerals Report for 2025, Exhibit 1.01 (SEC EDGAR)
• CISA: Hardware Bill of Materials (HBOM) Framework for Supply Chain Risk Management
• CISA: A Hardware Bill of Materials Framework for Supply Chain Risk Management, September 2023 (PDF)
• CycloneDX: Specification overview
• CycloneDX 1.7 JSON reference: component types
• Android Open Source Project: Create a software bill of materials (SBOM)
• Apple Platform Security: Boot process for iPhone and iPad devices
• European Commission: Smartphones and tablets, ecodesign and energy labelling
• European Commission: Batteries and the Batteries Regulation
• European Commission: Conflict Minerals Regulation
• USGS Mineral Commodity Summaries 2026: Cobalt (PDF)
• USGS Mineral Commodity Summaries 2026: Lithium (PDF)
• USGS Mineral Commodity Summaries 2026: Rare Earths (PDF)
• USGS Mineral Commodity Summaries 2026: Tantalum (PDF)
• USGS Mineral Commodity Summaries 2026: Tin (PDF)
• USGS Mineral Commodity Summaries 2026: Tungsten (PDF)
• USGS Mineral Commodity Summaries 2026: Gold (PDF)

Last reviewed: 23 October 2026.