You've finished this phase Next phase: Am I ready to file a report?
Only 35% of SMEs surveyed by ENISA in early 2026 produce a Software Bill of Materials for their products with digital elements. The CRA requires it — and treats SBOM as the entry point for vulnerability handling. This page explains the requirement, quantifies the gap and gives you a free scanner to close it today.
The second-lowest technical practice tracked by the survey, behind only threat modelling.
Source: ENISA SME CRA Survey 2026, Figure 7 (p. 17) and Table 15 (p. 25).
Without an SBOM, tracking known CVEs across your dependencies is guesswork — and impossible to sustain across a product's support period.
The CRA turns SBOM from a best-practice into a legal obligation for every in-scope product placed on the EU market.
Manufacturers must identify and document components contained in products — an SBOM is the practical way this is done. Standard formats: CycloneDX and SPDX.
During the declared support period, manufacturers must address vulnerabilities without delay. That requires a maintained SBOM linked to a vulnerability watch.
Actively-exploited vulnerabilities in components used by your product must be reported to ENISA within statutory deadlines (24h / 72h / 14 days) — an SBOM is the only reliable trigger source.
A free browser-only SBOM scanner and, once you sign up, continuous vulnerability watches across all your products.