If Your Software Ships to Europe, This Applies to You
The EU Cyber Resilience Act (CRA) entered into force in December 2024. The transition period sounds generous, but the milestones arrive quickly.
The regulation covers manufacturers, importers, and distributors placing "products with digital elements" on the EU market. This is not limited to packaged software. Embedded devices with firmware, industrial control software, and cloud-connected IoT products all fall within scope. HMI software on equipment that a Korean manufacturer ships to a European buyer is no exception.
What Level of Detail an SBOM Requires
Annex I of the CRA requires manufacturers to identify and document product components and to produce an SBOM in a commonly used machine-readable format covering at least top-level dependencies. In practice, you need:
The critical point is that this must exist before you are asked for it. Reconstructing the composition of a past release after an authority comes knocking is effectively impossible. Standardize on either SPDX or CycloneDX, wire a tool such as Syft or cdxgen into your CI/CD pipeline, and generate the SBOM on every build. Store the SBOM under the same version tag as the release artifact so the two remain traceable together.
The Operational Weight of Vulnerability Reporting
The deadlines that take effect in September 2026 are tight.
Reports go to the coordinating CSIRT and ENISA through a single reporting platform. Factoring in the European Vulnerability Database (EUVD) operated by ENISA adds another touchpoint. Meeting a 24-hour deadline is not a technical problem but an organizational one. Unless you document who judges whether exploitation is active, who signs and submits the report, and who covers when that person is unavailable, the clock will run out.
Why an SBOM Alone Does Not Reduce Supply Chain Attacks
Having an inventory does not by itself improve security. Programs commonly stall in these states:
The test is simple. If a CVE with a severity score in the nines were published today, could you list the affected products within minutes? If the answer is days rather than minutes, your SBOMs are a pile of files, not an asset.
Three Steps to Start Now
Step 1 — Product inventory and scope assessment: List every product and module, determine EU market exposure, classify each product (default, important, critical), and establish the basis for the minimum five-year support period.
Step 2 — Automate SBOM generation: Add SBOM generation, signing, and retention stages to your CI/CD pipeline, and store the output alongside each release artifact.
Step 3 — Formalize procedures and contracts: Document vulnerability monitoring, patch SLAs, named reporting owners and backups, and supplier SBOM delivery clauses.
The POLYGLOTSOFT Approach
POLYGLOTSOFT recommends integrating SBOM generation and verification into your existing build pipeline rather than rebuilding it from scratch. We design compliance frameworks that extend to deliverables from outsourcing partners and suppliers, and our subscription development and maintenance services keep you aligned with the September 2026 and December 2027 deadlines on an ongoing basis. If you are unsure how far your compliance scope should reach, start with a product inventory review and reach out to us.