Regulation (EU) 2024/2847
CRA Annex I — the software bill of materials obligation, quoted in full
“Manufacturers of products with digital elements shall: (1) identify and document vulnerabilities and components contained in products with digital elements, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the products.”
Annex I Part II point (1) is the provision that makes an SBOM mandatory under the CRA. It requires a machine-readable SBOM in a commonly used format, covering at minimum the top-level dependencies of the product.
Two details are widely misreported. First, the legal floor is "at the very least the top-level dependencies" — not the full transitive tree. Second, the Regulation does not require you to publish the SBOM to users at all.
Disclosure to users is explicitly optional: Annex II says that only "if the manufacturer decides to make available the software bill of materials to the user" must you say where it can be accessed. The mandatory disclosure is narrower — Article 31 requires the SBOM to be provided to a market surveillance authority "further to a reasoned request".
What it actually requires
- Format
- Commonly used and machine-readable. The Regulation names no specific format; CycloneDX and SPDX both satisfy this, and the Commission may specify format and elements later by implementing act.
- Depth
- At the very least top-level dependencies. Deeper transitive coverage is permitted and often advisable, but is not the legal minimum.
- Who receives it
- A market surveillance authority on reasoned request (Article 31). Users only if you choose to make it available (Annex II).
- Not a standalone duty
- The SBOM sits inside the vulnerability-handling requirements. Points (2) to (8) of the same Part II require remediation without delay, regular testing, public disclosure of fixed vulnerabilities, and a coordinated disclosure policy.
Dates that apply
| Date | What applies |
|---|---|
| 11 December 2027 | Annex I obligations, including the SBOM requirement, apply in full. |
| 11 September 2026 | Article 14 reporting obligations already apply from this date, ahead of the rest. |
The rest of the CRA
- CRA Article 14: the 24-Hour Reporting Clock
- CRA Article 13: Manufacturer Obligations Explained
- CRA Deadlines: Every Date That Applies
- EU Cyber Resilience Act — full compliance overview
Producing the Annex I SBOM and tracking which listed vulnerabilities actually affect your product is what O3 generates automatically, in CycloneDX or SPDX. Book a demo.