NEW: Build Arm / Keil SBOM with lynkctl

CRA Compliance

EU Cyber Resilience Act (CRA): SBOM requirements & compliance

CRA vulnerability reporting is now in effect; full application, including the SBOM, is due 11 December 2027. Interlynk automates the SBOM, vulnerability management, and documentation requirements you need.

NEXT CRA DEADLINE
Full CRA Application (SBOM Due)

Applies from 11 December 2027

000DAYS
00HOURS
00MINUTES

until full CRA application, SBOM included

NEXT CRA DEADLINE
Full CRA Application (SBOM Due)

Applies from 11 December 2027

000DAYS
00HOURS
00MINUTES

until full CRA application, SBOM included

NEXT CRA DEADLINE
Full CRA Application (SBOM Due)

Applies from 11 December 2027

000DAYS
00HOURS
00MINUTES

until full CRA application, SBOM included

Trusted by regulated product teams preparing for

EU CRA
EU CRA

Trusted by regulated product teams preparing for

EU CRA
EU CRA

Trusted by regulated product teams preparing for

EU CRA
EU CRA

IN SHORT

The Cyber Resilience Act (Regulation (EU) 2024/2847) is the European Union law that makes a software bill of materials mandatory.

If you sell a product with digital elements into the EU, you have to produce a machine-readable SBOM, keep it updated, and hand it over whenever a market surveillance authority asks for it.

Two dates matter. Vulnerability reporting has been in effect since 11 September 2026, and the rest of the obligations, SBOM included, apply from 11 December 2027. That ordering catches people out: reporting started fifteen months before the SBOM is formally due, and you cannot report on a component you have never inventoried.

The law asks only for your top-level dependencies. But that's the same gap that let Log4Shell slip through.

The Cyber Resilience Act (Regulation (EU) 2024/2847) is the European Union law that makes a software bill of materials mandatory.

If you sell a product with digital elements into the EU, you have to produce a machine-readable SBOM, keep it updated, and hand it over whenever a market surveillance authority asks for it.

Two dates matter. Vulnerability reporting has been in effect since 11 September 2026, and the rest of the obligations, SBOM included, apply from 11 December 2027. That ordering catches people out: reporting started fifteen months before the SBOM is formally due, and you cannot report on a component you have never inventoried.

The law asks only for your top-level dependencies. But that's the same gap that let Log4Shell slip through.

OVERVIEW

What is the Cyber Resilience Act?

What is the Cyber Resilience Act?

The EU Cyber Resilience Act (CRA) is the first horizontal EU regulation imposing mandatory cybersecurity requirements on hardware and software products with digital elements. It mandates secure-by-design principles, vulnerability handling, and lifecycle transparency for any product sold in the EU market, regardless of where the manufacturer is based.

The EU Cyber Resilience Act (CRA) is the first horizontal EU regulation imposing mandatory cybersecurity requirements on hardware and software products with digital elements. It mandates secure-by-design principles, vulnerability handling, and lifecycle transparency for any product sold in the EU market, regardless of where the manufacturer is based.

EURO 15M

Maximum fines for non-compliance

24 Hours

Vulnerability reporting window

Vulnerability reporting window

10 Years

SBOM retention requirement

SBOM retention requirement

90%

Products eligible for self-assessment

Products eligible for self-assessment

TIMELINE

CRA Compliance Timeline and Key EU Dates

CRA Compliance Timeline and Key EU Dates

CRA compliance timeline from December 2024 entry into force to December 2027 full application, with vulnerability reporting in effect since September 2026.

Date

Milestone

What it means

10 December 2024

Entry into force

Regulation takes effect. No manufacturer obligations yet.

11 June 2026

Conformity assessment body rules

Member States designate national authorities and notified bodies. No direct manufacturer duty.

August 2026

Horizontal standards deadline

Harmonised standards covering requirements common to all products with digital elements.

11 September 2026

Vulnerability reporting begins

24-hour early warning, 72-hour notification, 14-day final report. Applies to products already on the market.

October 2026

Vertical standards deadline

Harmonised standards for specific product categories.

20 January 2027

Machinery Regulation: applies

Connected machines need cybersecurity evidence in the technical file for CE marking.

11 December 2027

Full application

CE marking, conformity assessment, technical documentation, SBOM, secure-by-design, security updates across the support period.

SCOPE

Who Does the CRA Affect?

Who Does the CRA Affect?

The CRA applies to any product with digital elements placed on the EU market. That covers software sold on its own, hardware with embedded software, and the remote data-processing solutions those products depend on. A hospital infusion pump, an industrial controller, a mobile app and a firewall appliance all sit inside the same regulation.

Three roles carry obligations, and they are not interchangeable.

The CRA applies to any product with digital elements placed on the EU market. That covers software sold on its own, hardware with embedded software, and the remote data-processing solutions those products depend on. A hospital infusion pump, an industrial controller, a mobile app and a firewall appliance all sit inside the same regulation.

Three roles carry obligations, and they are not interchangeable.

Manufacturers

Anyone who develops, manufactures, or has products with digital elements designed and developed under their name or trademark.

Importers

Entities established in the EU that place a product with digital elements bearing a third-country manufacturer's name on the EU market.

Distributors

Any party in the supply chain, other than the manufacturer or importer, who makes a product with digital elements available in the EU market.

Note: An importer or distributor becomes a manufacturer if they place a product under their own name or substantially modify it.

Note: An importer or distributor becomes a manufacturer if they place a product under their

own name or substantially modify it.

MACHINERY

Does the EU Machinery Regulation Require an SBOM?

Does the EU Machinery Regulation Require an SBOM?

No. Regulation (EU) 2023/1230 does not mention SBOM, CycloneDX or SPDX anywhere.

It does ask for something close. Under Annex III 1.1.9, a machine has to identify the software it needs to run safely and make that information available at any time, in a form that is easy to get at. To satisfy that you will end up keeping a software inventory, even though the regulation never uses the word.

Most machine builders selling into the EU are covered by both regulations at once. They want different things.

No. Regulation (EU) 2023/1230 does not mention SBOM, CycloneDX or SPDX anywhere.

It does ask for something close. Under Annex III 1.1.9, a machine has to identify the software it needs to run safely and make that information available at any time, in a form that is easy to get at. To satisfy that you will end up keeping a software inventory, even though the regulation never uses the word.

Most machine builders selling into the EU are covered by both regulations at once. They want different things.

MACHINERY REGULATION (EU) 2023/1230

CYBER RESILIENCE ACT (EU) 2024/2847

Applies from

20 January 2027

Machinery Regulation: 20 January 2027

11 December 2027 (full application)

CRA: 11 December 2027 (full application)

Main concern

Whether someone can interfere digitally and cause a physical accident

Machinery Regulation: Whether someone can interfere digitally and cause a physical accident

Whether the product stays secure for its whole supported life

CRA: Whether the product stays secure for its whole supported life

Software covered

Software and data tied to safety functions

Machinery Regulation: Software and data tied to safety functions

Every digital element, dependencies included

CRA: Every digital element, dependencies included

SBOM

Not named. Annex III 1.1.9 requires software identification

Machinery Regulation: Not named. Annex III 1.1.9 requires software identification

Required, at least top-level dependencies

CRA: Required, at least top-level dependencies

Where the evidence goes

Technical file for CE marking

Machinery Regulation: Technical file for CE marking

Technical documentation, plus vulnerability handling and reporting

CRA: Technical documentation, plus vulnerability handling and reporting

The CRA is the bigger piece of work. Build an SBOM programme that meets it and the Machinery Regulation's software identification falls out of the same effort, with the vulnerability monitoring the CRA asks for on top.

Meeting one does not get you the other. The Machinery Regulation leaves the CRA's vulnerability handling, security updates and reporting untouched, and a CRA assessment does not answer the safety question the Machinery Regulation asks. The evidence does carry over, though. Risk assessments, SBOMs and vulnerability handling procedures built for the CRA go straight into your Machinery Regulation technical file.

Note: An importer or distributor becomes a manufacturer if they place a product under their

own name or substantially modify it.

The CRA is the bigger piece of work. Build an SBOM programme that meets it and the Machinery Regulation's software identification falls out of the same effort, with the vulnerability monitoring the CRA asks for on top.

Meeting one does not get you the other. The Machinery Regulation leaves the CRA's vulnerability handling, security updates and reporting untouched, and a CRA assessment does not answer the safety question the Machinery Regulation asks. The evidence does carry over, though. Risk assessments, SBOMs and vulnerability handling procedures built for the CRA go straight into your Machinery Regulation technical file.

CLASSIFICATION

Product Classification Under CRA

Product Classification Under CRA

Default (~90%)

Smart speakers, hard drives, photo editing software

Smart speakers, hard drives, photo editing software

Important Class I

Password managers, antivirus, VPNs, network interfaces

Password managers, antivirus, VPNs, network interfaces

Important Class II

Firewalls, IDS/IPS, hypervisors, container runtimes

Firewalls, IDS/IPS, hypervisors, container runtimes

Critical

Hardware security modules, smart meter gateways, smartcards

Hardware security modules, smart meter gateways, smartcards

SBOM REQUIREMENTS

SBOM Requirements Under CRA

SBOM Requirements Under CRA

The Cyber Resilience Act mandates comprehensive Software Bill of Materials documentation. The obligation is set out in Article 13(1)(h) together with Annex I, Part II, point (1) of Regulation (EU) 2024/2847.

Here are the key requirements you need to meet:

The Cyber Resilience Act mandates comprehensive Software Bill of Materials documentation. The obligation is set out in Article 13(1)(h) together with Annex I, Part II, point (1) of Regulation (EU) 2024/2847.

Here are the key requirements you need to meet:

☑️ Machine-readable SBOM format (CycloneDX or SPDX)
☑️ Include all top-level dependencies
☑️ Accurate version numbers for all components
☑️ Unique identifiers for each component
☑️ 10-year retention requirement for documentation
☑️ Regular updates when components change
☑️ Secure sharing mechanisms with authorized parties
☑️ Integration with vulnerability monitoring systems

☑️ Machine-readable SBOM format (CycloneDX or SPDX)
☑️ Include all top-level dependencies
☑️ Accurate version numbers for all components
☑️ Unique identifiers for each component
☑️ 10-year retention requirement for documentation
☑️ Regular updates when components change
☑️ Secure sharing mechanisms with authorized parties
☑️ Integration with vulnerability monitoring systems

☑️ Machine-readable SBOM format (CycloneDX or SPDX)
☑️ Include all top-level dependencies
☑️ Accurate version numbers for all components
☑️ Unique identifiers for each component
☑️ 10-year retention requirement for documentation
☑️ Regular updates when components change
☑️ Secure sharing mechanisms with authorized parties
☑️ Integration with vulnerability monitoring systems

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:...",
  "version": 1,
  "metadata": {
    "timestamp": "2026-01-15T10:00:00Z",
    "tools": [{
      "vendor": "Interlynk",
      "name": "SBOM Generator"
    }]
  },
  "components": [
    {
      "type": "library",
      "name": "example-lib",
      "version": "2.1.0",
      "purl": "pkg:npm/example-lib@2.1.0"
    }
  ]
}

The CRA asks only for top-level dependencies. That is the same gap that hid Log4j inside a framework inside a library during Log4Shell, so treat it as a floor rather than a target.

For the full breakdown of the CRA's SBOM data fields and how BSI TR-03183 interprets them, see SBOM requirements for the EU CRA.
Shipping a Windows driver as well? Microsoft has its own requirement: one SPDX 3 SBOM per driver package. See Windows driver SBOM requirements.

The CRA asks only for top-level dependencies. That is the same gap that hid Log4j inside a framework inside a library during Log4Shell, so treat it as a floor rather than a target.

For the full breakdown of the CRA's SBOM data fields and how BSI TR-03183 interprets them, see SBOM requirements for the EU CRA.
Shipping a Windows driver as well? Microsoft has its own requirement: one SPDX 3 SBOM per driver package. See Windows driver SBOM requirements.

REPORTING

Vulnerability Reporting Obligations

Vulnerability Reporting Obligations

Article 71(2) brings Article 14 forward to 11 September 2026, ahead of the rest of the regulation. Two events trigger a report: a vulnerability in your product being actively exploited, and a severe incident affecting its security.

Article 71(2) brings Article 14 forward to 11 September 2026, ahead of the rest of the regulation. Two events trigger a report: a vulnerability in your product being actively exploited, and a severe incident affecting its security.

24h

Clock starts at awareness, not confirmation

72 hrs

Initial severity assessment and mitigations

14 days

A workaround counts as a corrective measure

1 month

Runs from the 72-hour notification

STAGE

ACTIVELY EXPLOITED VULNERABILITY

SEVERE INCIDENT

Early Warning

Within 24 hours of becoming aware

Exploited vulnerability: Within 24 hours of becoming aware

Within 24 hours of becoming aware

Severe incident: Within 24 hours of becoming aware

Notification

Within 72 hours

Exploited vulnerability: Within 72 hours

Within 72 hours

Severe incident: Within 72 hours

Final report

Within 14 days of a corrective measure being available

Exploited vulnerability: Within 14 days of a corrective measure being available

Within one month of the 72-hour notification

Severe incident: Within one month of the 72-hour notification

WORTH KNOWING

  • Only actively exploited vulnerabilities and severe incidents are reportable. Flaws you find and fix before exploitation stay in normal vulnerability handling.

  • Applies to products already on the EU market, not only those placed after September 2026.

  • One submission through the ENISA Single Reporting Platform (Article 16) reaches both ENISA and your coordinating national CSIRT.

  • Microenterprises and small enterprises cannot be fined for missing the 24-hour early warning (Article 64(10)(a)). The obligation itself, and the later deadlines, still apply.

  • The CRA sets no deadline for developing the fix, but "without undue delay" applies and affected users must be informed under Article 14(8).

NEW • FREE RESOURCE

Choosing an SBOM platform for the CRA?

Choosing an SBOM platform for the CRA?

The CRA sets a floor, not a target. What actually holds up when a customer or an auditor reads your SBOM is a step beyond it. The rubric scores that gap:

The CRA sets a floor, not a target. What actually holds up when a customer or an auditor reads your SBOM is a step beyond it. The rubric scores that gap:

Minimum
Clears the CRA on paper

Audit-ready
What an auditor accepts

Depth

Top-level dependencies only

✓ Full transitive dependency tree

Cadence

Generated once, at documentation time

✓ Regenerated on every build

Vulnerability context

Not required

✓ Monitored for new vulnerabilities, with VEX

Format

A commonly used format

✓ Validated CycloneDX or SPDX (BSI TR-03183-2)

Preview of the SBOM Platform Evaluation Scorecard rubric

A demo and a sales pitch won’t tell you whether an SBOM platform holds up under the CRA. So we built this rubric. It’s a vendor-neutral way to test any platform, including your own, against what the CRA and BSI TR-03183-2 require. There are 66 checks across seven areas, each tied to a specific CRA or BSI requirement, and the summary tab does the math. By the end you can see where each tool is strong and where it falls short. Critical items are flagged, so a dealbreaker can’t slip past.

A demo and a sales pitch won’t tell you whether an SBOM platform holds up under the CRA. So we built this rubric. It’s a vendor-neutral way to test any platform, including your own, against what the CRA and BSI TR-03183-2 require. There are 66 checks across seven areas, each tied to a specific CRA or BSI requirement, and the summary tab does the math. By the end you can see where each tool is strong and where it falls short. Critical items are flagged, so a dealbreaker can’t slip past.

Generation

Content & Quality

Lifecycle

Vuln & VEX

Format

Integration

Beyond CRA

Get the rubric

Tell us where to send it and we’ll email it over.

PLATFORM

How Interlynk Helps

How Interlynk Helps

We map every CRA requirement to a concrete platform capability, so you can demonstrate compliance, not just claim it.

We map every CRA requirement to a concrete platform capability, so you can demonstrate compliance, not just claim it.

CRA Requirement
Interlynk Capability
SBOM creation & maintenance
Automated SBOM Management
Vulnerability identification
Continuous vulnerability monitoring
Dependency tracking
Open Source Management
Security update management
Supplier monitoring
Technical documentation
SBOM export in CycloneDX / SPDX
10-year retention
SBOM lifecycle management
CRA Requirement
Interlynk Capability
SBOM creation & maintenance
Automated SBOM Management
Vulnerability identification
Continuous vulnerability monitoring
Dependency tracking
Open Source Management
Security update management
Supplier monitoring
Technical documentation
SBOM export in CycloneDX / SPDX
10-year retention
SBOM lifecycle management

FAQ

FAQs

FAQs

What is the EU Cyber Resilience Act?

The CRA is an EU regulation establishing mandatory cybersecurity requirements for products with digital elements sold in the European Union. It covers hardware and software, requiring secure-by-design development, vulnerability handling, and ongoing security updates throughout the product lifecycle.

When does the CRA take effect?

Is SaaS covered by the CRA?

What SBOM format does the CRA require?

Which tools help with the CRA's SBOM requirement?

Is open-source software exempt from the CRA?

What are the penalties for CRA non-compliance?

How does the CRA differ from NIS2?

Do US companies need to comply with the CRA?

Are top-level dependencies enough for CRA compliance?

Trusted by security and compliance teams at 100+ regulated companies

Start Your CRA Compliance Journey

Join 100+ organizations already using Interlynk to automate SBOM management and meet EU regulatory requirements.

Trusted by security and compliance teams at 100+ regulated companies

Start Your CRA Compliance Journey

Join 100+ organizations already using Interlynk to automate SBOM management and meet EU regulatory requirements.

Trusted by security and compliance teams at 100+ regulated companies

Start Your CRA Compliance Journey

Join 100+ organizations already using Interlynk to automate SBOM management and meet EU regulatory requirements.

Features

SBOM Automation

Open Source Management

Supplier Monitoring

Post-Quantum Readiness

LynkMCP

Solutions

FDA 524B Compliance

CRA Compliance

Embedded C/C++ SBOM

Windows Driver SBOM

Resources

Guides

Blog

News

Docs

Open Source Tools

Comparisons

References

Company

About Us

Contact

Privacy Policy

Interlynk
© 2026 Interlynk Inc. All rights reserved

Features

SBOM Automation

Open Source Management

Supplier Monitoring

Post-Quantum Readiness

LynkMCP

Solutions

FDA 524B Compliance

CRA Compliance

Embedded C/C++ SBOM

Windows Driver SBOM

Resources

Guides

Blog

News

Docs

Open Source Tools

Comparisons

References

Company

About Us

Contact

Privacy Policy

Interlynk
© 2026 Interlynk Inc. All rights reserved

Features

SBOM Automation

Open Source Management

Supplier Monitoring

Post-Quantum Readiness

LynkMCP

Solutions

FDA 524B Compliance

CRA Compliance

Embedded C/C++ SBOM

Windows Driver SBOM

Resources

Guides

Blog

News

Docs

Open Source Tools

Comparisons

References

Company

About Us

Contact

Privacy Policy

Interlynk
© 2026 Interlynk Inc. All rights reserved