Skip to main content
euvex
Console

The SBOM, in plain words

What it is, why regulation is taking it up, when it becomes a requirement, and what the file really looks like. No technical background needed.

What is an SBOM, in plain words?

Think of the ingredients label on a can of ravioli: everything inside, in order, with the quantities. An SBOM (Software Bill of Materials) is exactly that, but for a piece of software.

Beef ravioli · 400 g

Ingredients

  • Wheat flour38%
  • Beef21%
  • Eggs8%
  • Salt1.2%
  • Preservative E2500.01%
If E250 is banned tomorrow, every can that contains it is taken off the shelves.

illustration

same principle

checkout-service@2.4.1

sbom.cdx.json

  • express4.18.2
  • lodash4.17.21
  • react18.2.0
  • axios1.6.7
  • log4js6.4.0
If a CVE hits log4js 6.4.0, every app that depends on it is listed.

illustration

Modern software is a handful of files written in-house and hundreds of open source libraries written by strangers. Without an SBOM, when a flaw hits one of them, nobody knows which applications are affected.

Why everyone is getting into it now

December 2021. A very widespread Java logging library, log4j, turns out to be vulnerable. It is used (without anyone knowing exactly where) by millions of applications around the world: banks, hospitals, Apple, Tesla, Minecraft. The panic did not last because of the flaw itself, but because nobody knew where it was hiding.

  1. your-application
  2. library-a
  3. library-b
  4. library-c
  5. log4j-core 2.14.1CVE-2021-44228
illustration · the flaw is here, four levels down: invisible without an SBOM

Even before Log4Shell, Executive Order 14028 (United States, May 2021) listed providing an SBOM to the purchaser among the practices expected of software suppliers to the federal government. Log4Shell showed why. Then:

  • Cyber Resilience Act (EU, 2024): an SBOM required in the technical documentation of products with digital elements placed on the EU market, outside the exclusions of Art. 2. Applicable from 11.12.2027.
  • Fines of up to €15 million or 2.5% of worldwide annual turnover for non-compliance.

The most common mix-up

11 September 2026 comes up everywhere as “the SBOM deadline”. It is not: that date is the one for reporting actively exploited vulnerabilities (Art. 14). The essential requirements, including the SBOM (Annex I, Part II, point 1), are applicable from 11 December 2027 (Art. 71(2)). Two distinct obligations, two distinct dates.

What an SBOM really looks like

A JSON file in the standard CycloneDX 1.5 format, an OWASP project. A commonly used and machine-readable format, which is what Annex I, Part II, point 1 of the CRA asks for: vulnerability search tools read it, and so does your future acquirer.

sbom.cdx.jsonsample
{  "bomFormat": "CycloneDX",  "specVersion": "1.5",  "serialNumber": "urn:uuid:3e8a7c4f-9b1d-4e2a-...",  "metadata": {    "timestamp": "2026-05-28T14:32:00Z",    "component": {      "name": "checkout-service",      "version": "2.4.1"    }  },  "components": [    {      "bom-ref": "pkg:npm/express@4.18.2",      "type": "library",      "name": "express",      "version": "4.18.2",      "purl": "pkg:npm/express@4.18.2",      "licenses": [{ "license": { "id": "MIT" } }],      "hashes": [{ "alg": "SHA-512", "content": "wYn7g5Y3..." }]    }  ]}

For each dependency:

Yours, in thirty seconds

Upload a lockfile (npm, pnpm, yarn) or an existing CycloneDX or SPDX SBOM. A free account is enough, and the file is not kept.

Generate an SBOM (in French)What euvex provides