EU CRA SBOM Implementation Checklist

Before you start

• Classify every in-scope product by CRA tier (default, important, or critical)
• Choose a machine-readable SBOM format — SPDX and CycloneDX have the broadest tooling support
• Identify every build pipeline that produces an in-scope product

Build the pipeline

• Generate the SBOM as part of the build process, not as a manual, point-in-time export
• Capture the full dependency tree — application code, third-party libraries, and transitive dependencies
• Version the SBOM alongside the release it describes
• Automate SBOM regeneration on every release, not just major versions

Operationalize it

• Make the SBOM producible to a market surveillance authority on request
• Feed the SBOM into vulnerability-triage tooling so a newly disclosed CVE can be checked against your actual dependency tree quickly
• Review and refresh the SBOM process whenever the build pipeline itself changes