A library interior with bookshelves flanking an arched doorway

CRA SBOM Requirements: CycloneDX, SPDX, and HBOM

Build, exchange, and govern Software Bills of Materials in CycloneDX or SPDX so they meet CRA requirements before the December 2027 deadline.

Build your SBOM expertise

Six focused guides covering what the CRA requires, format choice, the BSI TR-03183 quality benchmark, hardware bills of materials, common mistakes, and the deadline-and-penalty timeline.

What the CRA requires in an SBOM

SBOMs are mandatory under the CRA for every product with digital elements. See exactly what the regulation requires (and what it does not).

Read guide →
Pick the right SBOM format: CycloneDX or SPDX

Both formats qualify under the CRA. Compare CycloneDX and SPDX on tooling, VEX support, and BSI TR-03183 compatibility before you commit.

Read guide →
Meet the BSI TR-03183 SBOM standard

The CRA names no fields and no version floor. BSI TR-03183 fills the gap with mandatory data fields, a CycloneDX 1.6 floor, and SPDX 3.0.1.

Read guide →
Build a Hardware Bill of Materials (HBOM)

Your SBOM lists software, but Article 3(1), Article 13(5), and Annex I also cover hardware. Learn when an HBOM is required and what it must contain.

Read guide →
Avoid the most common SBOM mistakes

Six SBOM gaps that surface during audits: shallow trees, stale snapshots, missing identity fields, and the others most manufacturers miss before December 2027.

Read guide →
SBOM deadlines and Article 64 penalties

Article 14 vulnerability reporting becomes mandatory on 11 September 2026. Full enforcement follows on 11 December 2027. Fines reach EUR 15 million or 2.5% of turnover.

Read guide →
← Back to CRA compliance hub