A library interior with bookshelves flanking an arched doorway

CRA SBOM Complete Guide: Requirements and Formats

Build, exchange, and govern Software Bills of Materials in commonly used, machine-readable formats before CRA requirements apply from 11 December 2027.

Build your SBOM expertise

Five focused guides covering what the CRA requires, format choice, the BSI TR-03183 quality benchmark, hardware bills of materials, and common mistakes.

What the CRA requires in an SBOM

SBOMs are mandatory under the CRA for every product with digital elements. See exactly what the regulation requires (and what it does not).

Read guide →
Pick the right SBOM format: CycloneDX or SPDX

The CRA does not name one SBOM format. Compare CycloneDX and SPDX on tooling, VEX support, and BSI TR-03183 compatibility before you commit.

Read guide →
Meet the BSI TR-03183 SBOM standard

The CRA names no fields and no version floor. BSI TR-03183 gives practical implementation guidance for SBOM data quality and exchange.

Read guide →
Track hardware and firmware with an HBOM

Your SBOM covers software. For connected hardware, an HBOM tracks chips, modules, firmware, support dates, and supplier evidence.

Read guide →
Avoid the most common SBOM mistakes

Six SBOM gaps that surface during audits: shallow trees, stale snapshots, missing identity fields, and the others manufacturers should close before 11 December 2027.

Read guide →
← Back to CRA compliance hub