SBOM expectations are converging across countries. The 2026 Minimum Elements guidance, published 29 July 2026, carries the names of agencies from more than a dozen countries, and the EU's Cyber Resilience Act and Germany's BSI technical guideline add their own detail. Treat them as one direction with local differences.
Who signed the 2026 guidance?
CISA's announcement says CISA, the NSA, the FBI and international partners released the joint guidance, which updates and replaces the NTIA minimum elements from 2021. The header of the document itself lists the agencies: CISA, NSA, FBI, ASD's ACSC, Cyber Centre, NUKIB, ANSSI, BSI, CERT-In, ACN, METI, NCO, NIS/NCSC, KISA, NCSC-NL, NCSC-NZ, NASK and NBU.
It states that SBOM adoption is spreading globally and that the importance of harmonizing expectations will only increase. It also says the minimum elements do not create new requirements. They describe how organizations should generate and request SBOMs.
A related note in the document: CISA and G7 partners released joint guidance on SBOM for AI minimum elements in May 2026.
What does the EU add?
The European Commission's Cyber Resilience Act page says the act introduces mandatory cybersecurity requirements for manufacturers of products with digital elements. It entered into force on 10 December 2024. Reporting obligations apply from 11 September 2026, and the main obligations from 11 December 2027. The page does not itself spell out SBOM detail, so read the legal text for what applies to your product class.
What does Germany add?
The BSI technical guideline TR-03183 is organized in parts. Part 2 covers SBOM formal and technical requirements, and BSI's page says version 2.1.0 added a recommended mapping between its data fields and the SPDX and CycloneDX formats. It is tied to the CRA, for manufacturers who want to show how they meet it.
Where do the approaches differ?
In the United States, SBOM terms depend on the buyer. OMB memo M-26-05 lets agencies choose contract terms requiring an SBOM on request. In the EU, the CRA is law for in-scope products, with details still being worked out through guidance and standards. Formats converge: the 2026 document names SPDX and CycloneDX as the two widely used formats.
Constructed example: a vendor in Canada sells monitoring software to a US federal agency and a German manufacturer. It generates a CycloneDX SBOM per release with the 2026 elements. The US contract asks for it on request. The German customer asks how fields map to TR-03183 Part 2. One pipeline serves both, with a mapping document for the second.
Does a global baseline make compliance easier?
It makes the technical work easier and the legal work no simpler. One schema and one pipeline reduce engineering effort. But whether an SBOM is required, who must receive it and what else must accompany it still differ by market, product type and contract.
Keep two lists. One is technical: formats, fields, signing, delivery. The other is legal: which rules apply to which product in which country. Review the second list with counsel at least yearly, since dates and guidance are moving. The CRA timeline alone has several dates between 2026 and 2027.
What to do
- Pick the 2026 minimum elements as your baseline schema.
- Produce SBOMs in SPDX or CycloneDX, current versions.
- List the markets where you sell and check each for local SBOM or CRA terms.
- Keep a field mapping for stricter local guidance, such as TR-03183.
- Plan for the CRA dates if you ship products with digital elements into the EU.
- Ask legal counsel which obligations bind your products. This post is not legal advice.
Safeguard provides SBOM and dependency scanning and compliance automation to help keep inventory and evidence in one place. Whether you meet a given law is for you and your counsel to decide.
What does the AI angle add?
The 2026 document says AI systems can be components of software and that the minimum elements apply to AI software, while noting that extra data such as model cards or data cards may be useful and that it adds no AI specific elements. For AI products, keep the baseline SBOM and look at the separate G7 guidance on SBOM for AI for further fields customers may ask about.
Quick check
Does the 2026 guidance create a legal requirement?
It says it does not create new requirements. Requirements come from contracts, laws and agency policy.
Which format should I choose?
SPDX and CycloneDX are both named as widely used. Support whichever your customers need.
Sources
- CISA, 2026 Minimum Elements for a Software Bill of Materials (SBOM)
- 2026 Minimum Elements for a Software Bill of Materials (full PDF)
- European Commission, Cyber Resilience Act
- BSI, Technical Guideline TR-03183
- OMB M-26-05 (23 January 2026)
Last reviewed: 18 October 2026.
