When you buy a connected component for a vehicle or robot, ask the supplier for a software bill of materials, a support period, a signed update path, a vulnerability reporting process and a clear account of where code comes from. Regulation is moving toward these answers, so it is easier to ask now than to retrofit later.
Why the questions are changing
Two public sources show the direction. The US rule on connected vehicles restricts certain software and hardware with a nexus to China or Russia, with software prohibitions starting at model year 2027. The EU Cyber Resilience Act refers to software bills of materials, a support period of no less than five years in its recitals and vulnerability handling that covers all integrated components. This is not legal advice, and your product's scope needs checking.
The question list
Inventory
- Can you give us an SBOM for each release, including transitive dependencies?
- How often is it regenerated, and is it tied to the exact build we receive?
- Which components are maintained by third parties, and which are your own?
Provenance
- Where is the code written and maintained, and by whom?
- Which of your components come from suppliers in other jurisdictions?
- Can you describe the chain from source to signed binary?
Updates
- Are updates signed, and does the device verify them before install?
- Can the device reject an old, replayed update?
- What happens if an update fails halfway?
- Can you update in the field without a service visit?
Vulnerability handling
- How do outsiders report a vulnerability to you, and who reads it?
- How quickly do you tell customers when a component in our build is affected?
- For how long will you provide security updates? Is that in the contract?
Identity and access
- Does each device have its own credentials?
- What do your support and installer tools allow, and how are they protected?
Evidence
- What independent testing have you had, and can we see a summary?
How to use the answers
Score each answer as clear, partial or missing, and record the date. Missing answers become contract items or risk acceptances. Vague answers are a signal to ask a follow-up, not to accept.
Treat the supplier's SBOM as input to your own. When a component is disclosed as vulnerable, you want to search your inventory across suppliers in minutes. Safeguard can ingest and scan SBOMs and dependency data for software you build, and its reachability analysis can help prioritize which findings matter first.
What not to ask for
Do not ask a supplier to claim a certification they do not hold, and do not accept a vague statement in place of a document. Ask for the specific artifact.
Quick check
Should a small supplier be able to answer all of these?
Many can answer most of them. A supplier who cannot say how they receive vulnerability reports is worth a conversation before you buy.
Sources
- Commerce finalizes rule to secure connected vehicle supply chains (BIS)
- Regulation (EU) 2024/2847, Cyber Resilience Act (EUR-Lex)
Last reviewed: 19 October 2026.
