Don’t miss out on the latest news and updates about CE!Register now for the CE information service
Share Article
On 22 October 2026, the European Union Agency for Cybersecurity (ENISA) published the ENISA Technical Advisory for Software Bill of Materials. This technical guidance helps manufacturers systematically create and manage Software Bills of Materials (SBOMs) and securely integrate them into existing development processes.
The publication focuses on the SBOM lifecycle, potential security risks associated with handling SBOM data, and appropriate technical and organisational safeguards. It therefore provides practical support, particularly for small and medium-sized enterprises (SMEs), in establishing and securing SBOM processes.
Against the backdrop of the Cyber Resilience Act (CRA), this topic is becoming increasingly important. But what exactly is an SBOM, what legal requirements apply to manufacturers, and how can these requirements be implemented in practice?
What is a Software Bill of Materials (SBOM)?
A Software Bill of Materials (SBOM) is a structured inventory of the software components that make up a product.
Similar to a conventional bill of materials in mechanical engineering, an SBOM documents the constituent parts of a product. While a traditional bill of materials lists mechanical and electrical components, for example, an SBOM describes the software components included in a product and their dependencies.
This may include the following information:
An SBOM enables manufacturers to determine which products and software versions may be affected by a newly discovered security vulnerability.
For example, a machinery manufacturer integrates various software libraries and third-party components into the control system of a production machine. Using an SBOM, the manufacturer can check whether the libraries in use contain known security vulnerabilities, both during development (Secure by Design) and in systems already deployed in the field (vulnerability management). Affected components can then be updated or replaced at an early stage.
The Cyber Resilience Act (EU) 2024/2847 establishes mandatory cybersecurity requirements for products with digital elements.
Under Article 13 in conjunction with Annex I, Part II, point 1, manufacturers must identify and document vulnerabilities and components contained in their products. This includes creating a Software Bill of Materials in a commonly used, machine-readable format. The Technical Advisory identifies two examples of suitable formats, which are discussed below.
The CRA requires manufacturers to document at least the top-level dependencies. A complete breakdown of all indirect software dependencies is therefore not generally specified as a minimum legal requirement.
The SBOM forms part of the product's technical documentation. Manufacturers are generally not required to make this information publicly available. However, competent market surveillance authorities may request the relevant information within the scope of their powers.
The vulnerability-handling requirements set out in Annex I, Part II, generally apply from 11 December 2027. Nevertheless, manufacturers should already be taking steps to establish appropriate processes.
Which manufacturers and products are affected by the SBOM requirements?
The CRA does not apply exclusively to standalone software products. In principle, it also covers hardware products with digital elements, provided they fall within the scope of the Regulation.
Consequently, the requirements concerning Software Bills of Materials (SBOMs) are also relevant to manufacturers that integrate software into their machinery, industrial installations or devices.
Examples of potentially affected product categories include:
Standalone software products and applications also generally fall within the scope of the CRA.
In mechanical and plant engineering in particular, different software components are frequently combined. In addition to internally developed software, manufacturers may use operating systems, communication libraries or third-party open-source components.
It is therefore important for manufacturers to maintain an overview of the software components used and their dependencies. An SBOM provides the necessary transparency and helps identify known security vulnerabilities and assess potential risks in a targeted manner.
Manufacturers should therefore establish suitable processes to systematically identify software components, document them in a traceable manner and keep the relevant information up to date throughout the product lifecycle.
ENISA Technical Advisory: How can an SBOM be implemented in practice?
On 22 October 2026, ENISA published its Technical Advisory for Software Bill of Materials. This guidance is aimed particularly at small and medium-sized enterprises and organisations seeking to introduce systematic SBOM processes for the first time.
The document focuses on three main areas:
1. SBOM Structure and Lifecycle: ENISA explains how SBOM information can be generated, verified, stored, used and updated during software development. Automating SBOM generation as far as possible can help prevent errors and ensure that documentation remains up to date when software changes are made.
2. Security Risks associated with SBOM Data: The SBOM itself must also be protected. For example, if component information is manipulated or modified without authorisation, security assessments based on that information may produce incorrect results. The document therefore addresses potential threats associated with the creation, storage and sharing of SBOM data.
3. Technical and organisational security measures: The publication describes measures to secure the SBOM lifecycle. These include access controls, integrity checks and secure management of the generated documents.
The ENISA publication provides technical guidance. It does not introduce any additional legal obligations beyond the requirements of the CRA.
The publication therefore addresses not only the creation of a Software Bill of Materials but also its secure management and use.
Manufacturers receive technical guidance on how to establish structured SBOM processes and take potential security risks associated with handling SBOM data into account. The publication serves as technical guidance and does not establish any additional legal obligations beyond those set out in the Cyber Resilience Act.
The full text of the ENISA Technical Advisory is available to view and download here:
ENISA Technical Advisory for Software Bills of Materials
What technical formats are available for software bills of materials?
Standardised exchange formats have been established to enable the automated creation and processing of Software Bills of Materials. The most widely recognised formats include:
Both formats enable the structured processing of software component information. Further technical guidance is provided in BSI TR-03183 Part 2 guideline ‘Software Bill of Materials (SBOM)’ issued by the German Federal Office for Information Security (BSI). Among other things, this technical guideline specifies requirements relating to data fields, component information and the structure of Software Bills of Materials.
It is important to distinguish between legal requirements and technical specifications. The BSI guideline provides valuable guidance for implementation but is not automatically a harmonised standard under the CRA.
How can manufacturers implement SBOM requirements?
Manufacturers are advised to integrate SBOM processes into their existing development and documentation workflows at an early stage. The following steps are particularly useful:
1. Identify software components: The first step is to determine which software components are used in the respective products. This includes both internally developed components and third-party software.
2. Select a suitable SBOM format: Manufacturers should assess which standardised exchange format best suits their development environment and existing processes.
3. Automate creation where possible: Suitable tools can be used during software development to automatically generate and update Software Bills of Materials.
4. Integrate the SBOM into vulnerability management: It should be possible to compare the documented software components against information on known security vulnerabilities.
5. Ensure documentation and updates: Whenever software components change, the associated information must be maintained in a traceable manner.
Appropriate responsibilities and procedures must be defined for this purpose. An SBOM should not be regarded as an isolated document but rather as part of a comprehensive process for ensuring product cybersecurity.
The Cyber Resilience Act is significantly increasing the importance of transparent documentation of software components.
A Software Bill of Materials helps manufacturers track the software components used in their products, identify potential security vulnerabilities more quickly and systematically organise vulnerability management.
The new ENISA publication from October 2026 provides practical guidance, particularly for small and medium-sized enterprises, on establishing appropriate processes. Manufacturers of machinery, industrial installations and other products with digital elements should therefore assess at an early stage how Software Bills of Materials can be integrated into their existing development, documentation and cybersecurity processes.
Posted on: October 2026
Hendrik Stupin
Trained technical editor (tekom-certified) and certified CE coordinator. Previously 11 years of experience in technical communication and as a CE coordinator in the field of mechanical and plant engineering, specialising in ‘Engineered to Order (ETO)’ products.
E-Mail: hendrik.stupin@ibf-solutions.com| www.ibf-solutions.com
Wolfgang Reich CE marking and safety expert HTL electrical engineering, specialising in power engineering (Dipl.-HTL-Ing.), 20 years of experience in CE marking, machine safety, conversion of machines, electrical engineering and explosion protection, 10 years of which at TÜV Austria and Intertek Deutschland GmbH. Chairman of the master craftsman examination commission in the Styrian Chamber of Commerce for mechatronics (automation technology and electronics).
E-Mail: wolfgang.reich@ibf-solutions.com
CE software for systematic and professional safety engineering
Practical seminars on aspects of risk assessment and ce marking
With the CE InfoService you stay informed about important developments in the field of product safety.