A software bill of materials is a machine-readable inventory of software components and their relationships. In CRA work, the term should be understood in the context of the product, its supported release and the relevant legal duty.
What it means in practice
Use the SBOM to connect component identities to a particular product release. CycloneDX and SPDX are common formats. The CRA minimum covers at least top-level dependencies; operational coverage may need to go deeper.
How to use the term in a product review
Begin by asking which product version the discussion concerns. Record the source of the information and the person responsible for reviewing it. A familiar acronym can conceal different assumptions between a firmware engineer, a compliance manager and a supplier. Write down the intended meaning in the technical evidence so those assumptions can be checked later.
Distinguish an input, an engineering conclusion and a formal conformity decision. A tool output can be a useful input without proving that an obligation is fulfilled. A reviewer needs to see the underlying artifact, the relevant requirement and the rationale connecting the two. Keep uncertain facts visible and assign a follow-up rather than silently turning an unknown into an approval.
Related work
Read the practical guide for the operational workflow and the Cyber Resilience Act overview for the broader obligations. Connect product evidence to the release inventory and ensure the incident contact understands the Article 14 process.
A useful question to ask your supplier
Ask for an example linked to an actual release and a description of who reviews it. Clarify what is automated, what an engineer decides and what remains the manufacturer’s responsibility. This separates a useful deliverable from an unexplained label in a sales presentation. External tools and advisers can support the work, but the manufacturer remains accountable for product obligations.
An illustrative engineering scenario
For example, a Linux sensor image may contain a networking library that never appears in the companion app’s lockfile. Reviewing only the app inventory would miss it. Generate evidence from each element of the agreed product boundary, map the resulting inventories to the release and check a sample against the delivered artifact. Preserve vendor patch references where the reported upstream version does not tell the complete story. Keep development-only packages distinguishable from the code shipped to users.
Review questions for the product owner
Ask which product and supported version the evidence describes, which facts were checked directly and which remain assumptions. Identify the reviewer who can explain the result and the artifact that supports it. A document should not become authoritative merely because it appears in a customer portal. If its boundary is narrower than the finished product, make that limitation clear to everyone relying on it.
Check how this information enters the release process. Decide who updates the record after a component change, a new function, a supplier advisory or a change in the product’s support status. Keep older decisions available for older supported versions. Copying the latest release’s conclusion onto every branch can hide differences that matter to vulnerability handling and customer communication.
A handover that remains useful
Give the next engineer the source reference, the technical conclusion, the remaining uncertainty and the next action. Define what evidence would close an open question, who owns that work and when the team will review it. This turns a glossary concept into a practical engineering task rather than an unexplained acronym.
External suppliers can help create and maintain these records, but the manufacturer still needs to understand the basis for its decisions. Clarify which work is automated, which requires engineering judgment and which needs a separate conformity or legal specialist. Preserve the reasoning in a form your team can inspect and export. The goal is continuity across releases and personnel changes, with an evidence trail that remains connected to the actual product.
Sources
General engineering information, reviewed on the date above. Product-specific interpretations and current standards should be checked before a conformity decision. Roja helps manufacturers prepare for the Cyber Resilience Act. We do not certify products or provide legal advice.