Cyber Resilience Act | Underlying Link Between Reporting Obligations and SBOM
When software supply chain transparency becomes a legal obligation, SBOM is no longer an add-on but an infrastructure.
Previously, we have interpreted the CRA reporting obligation taking effect on September 11th, and the legal requirements of SBOM (Software Bill of Materials) within the CRA framework.
In compliance preparations, some manufacturers may treat these two matters as two separate compliance tasks to be carried out independently. In fact, in the design of the CRA system, SBOM and reporting obligations are not two separate matters, but rather the front and back ends of the same vulnerability management loop: SBOM is the foundation for reporting, and reporting is where the value of SBOM is fully realized. Without an accurate and queryable SBOM, it is technically difficult to complete the 24-hour reporting within the 24-hour legal time limit.
Common Compliance Misconceptions
Misconception 1: SBOM and reporting obligations are two independent compliance lines
These two are not parallel but sequential. The quality of SBOM directly determines the quality of reporting - if the SBOM is not queryable, it will be impossible to determine the scope of affected products within 24 hours; if the SBOM is inaccurate, the content of the complete notification within 72 hours will be incorrect.
Misconception 2: SBOM requirements only apply from 2027, and currently only the reporting obligations need to be fulfilled
The CRA compliance is implemented in phases: the reporting obligations will take effect on September 11th, 2026, and the main product compliance obligations (including the CE mark) will be fully implemented on December 11th, 2027. However, in the actual implementation of the reporting obligations, the use of SBOM is already necessary. After the reporting obligations take effect on September 11th, the complete notification within 72 hours must include the scope of affected products and risk assessment - the underlying data source for these two items is the SBOM. Without the support of SBOM, it is actually impossible to complete the reporting in a timely and compliant manner.
How SBOM Supports Reporting Obligations
1. Safeguard the 24-hour reporting lifeline
When a high-risk vulnerability is disclosed, manufacturers need to match the vulnerability CVE number with the component version in the SBOM to quickly determine whether it affects their own products. Without a complete and timely updated SBOM, it is difficult to complete the impact determination within the 24-hour legal time limit, resulting in reporting violations.
2. Provide complete technical evidence for the 72-hour complete reporting
The 72-hour reporting requires submitting technical details such as the impact range, component versions involved, and affected product model versions, all of which are drawn direclty from the SBOM. During the subsequent audits, the regulators will also retrieve the SBOM to verify the authenticity of the manufacturer's reporting content and prove that the manufacturer has fulfilled the due diligence obligation.
3. Run through the entire vulnerability lifecycle
Reporting vulnerabilities does not mean submitting a form and it is over. Subsequent locating affected devices, assessing risk levels, developing security patches, and issuing final disposal reports, the entire loop requires SBOM as the data source. During product iteration and upgrade, SBOM must be updated synchronously, and for the old and existing products sold to the EU, they also need to maintain the available SBOM. The reporting obligations cover existing products, not just new products.
Challenges for Manufacturers in Compliance Implementation
Currently, the main challenges faced by manufacturers are mostly limited by the lack and imperfection of SBOM compliance.
1. The non-compliance of SBOM quality may cause problems such as difficulty in meeting reporting deadlines, missing reporting content, insufficient accuracy, weak emergency response capabilities, and low assessment efficiency, ultimately affecting the mandatory reporting obligations that will take effect in September.
2. The vulnerability management involved in the reporting obligations, the CRA requires manufacturers to provide at least 5 years of vulnerability management services for their products, and they need to continuously complete control and reporting during this period. Manufacturers face the problem of high pressure on human resources and tool investment.
3. There is a large area of blank SBOM for existing products. The existing products sold in the EU without corresponding compliance SBOM. The CRA vulnerability reporting obligation covers all products, and existing products do not have standardized SBOMs. In the event of a vulnerability outbreak, it will be impossible to assess the risks or determine the scope of impact, making it difficult to meet the reporting deadlines.
What Toby Can Do for You
Automatically generate SBOM, offer SaaS cloud services to complete automated vulnerability reporting, fulfill reporting obligations, save relevant human resources and time for enterprises, and help products comply with regulations.
Toby has obtained A2LA accreditation and EN 18031 certification. We provide reliable cybersecurity testing and technical support that is closely aligned with standard requirements, helping your products enter the EU market.
The reporting obligation that will take effect on September 11th is essentially not a test of the reporting process, but a test of the transparency of the software supply chain of enterprises.
If you have requirements for SBOM generation, compliance reporting, etc. in cybersecurity, please contact Toby.
About Toby Testing
Toby Testing is a third-party testing company with CMA and ISO 17025 accreditations from CNAS and A2LA. Operating two laboratories in Shenzhen, China, Toby specializes in electronic and electrical (E&E) product safety, EMC, wireless, chemical, and physical testing and certification. With advanced facilities and expert staff, Toby delivers global market access solutions, enabling clients to expand into international markets.