Question 1

Do I need an SBOM right now?

Accepted Answer

The duty applies from 11 December 2027 (CRA Art. 71(2)). Reporting of actively exploited vulnerabilities already applies since 11 September 2026, and an SBOM is the quickest way to know what you ship.

Question 2

Is CycloneDX or SPDX mandatory?

Accepted Answer

Neither. The law asks for a commonly used, machine-readable format (CRA Annex I Part II(1)). Both are commonly used; pick the one your tools support. Watch for an implementing act under Art. 13(24).

Question 3

Must I publish my SBOM or give it to customers?

Accepted Answer

No (CRA Recital 77). Customers may ask for it in contracts; that is a commercial question, not a CRA duty.

Question 4

How deep must it go?

Accepted Answer

At least top-level dependencies (CRA Annex I Part II(1)). Deeper SBOMs help you answer "are we affected?" faster.

Question 5

Does a SaaS product need an SBOM?

Accepted Answer

If the product is in scope, yes, and its remote data processing solutions are part of the product (CRA Art. 3(1)–(2)). See Does the Cyber Resilience Act apply to SaaS?.

Question 6

How long do I keep old SBOMs?

Accepted Answer

As part of the technical documentation: at least 10 years after placing on the market, or the support period if longer (CRA Art. 13(13)).

Question 7

Is a VEX file required?

Accepted Answer

The CRA does not mention VEX. It can be a useful record of why a component vulnerability does not affect your product (Art. 13(7)).