Definition

Software bill of materials (SBOM)

Also: SBOM

A machine-readable inventory of the software components a product contains, required by the CRA at least for top-level dependencies.

A formal record containing details and supply-chain relationships of the components included in the software elements of a product with digital elements. Annex I Part II(1) requires manufacturers to draw up an SBOM in a commonly used and machine-readable format covering at least the top-level dependencies. CycloneDX and SPDX are the two mainstream formats. The SBOM is part of the technical documentation and must be made available to market surveillance authorities on request; publication is not required.

Reference: Art. 3 (definition); Annex I Part II(1); Annex VII · Regulation (EU) 2024/2847 on EUR-Lex

Updated 2026-09-26 · Paraphrase for orientation, not legal advice.