Your European client's contract now requires an SBOM under Regulation (EU) 2024/2847. Annex VII §2(b) specifies the software bill of materials as part of the technical documentation. Your CI/CD pipeline generates a CycloneDX or SPDX file. That is not what your client means. They need the SBOM integrated into the Annex VII documentation structure. CRACheck generates the complete 8-document dossier — SBOM included.

Indian development teams adopted SBOM tooling years before the CRA existed. Syft, Trivy, CycloneDX — the pipeline produces machine-readable dependency lists on every build. But Annex VII §2(b) of Regulation (EU) 2024/2847 requires the SBOM as part of the vulnerability handling documentation, alongside the coordinated vulnerability disclosure policy and evidence of secure update distribution. The contractual requirement is not "send us a JSON file." It is "deliver Annex VII technical documentation that includes the SBOM in context." CRACheck structures the entire dossier: 8 PDF documents, SBOM contextualised within Annex VII §2(b), 15–25 minutes, €149 per product. 100% browser-side.

Generate Annex VII dossier — €149 Free: check if your product is in scope

€149 one-time · 8-document ZIP · 15–25 minutes · Browser-side

Key numbers

Annex VII §2(b)

SBOM required as part of vulnerability handling documentation. Not a standalone deliverable.

Annex I Part II §1

Identify and document vulnerabilities and components. SBOM in machine-readable format covering top-level dependencies.

€149

Complete Annex VII dossier with SBOM in context. Not just the raw dependency file.

How it works

Understand what the CRA requires for SBOM

Annex I Part II §1 requires manufacturers to draw up an SBOM in a commonly used and machine-readable format covering at least the top-level dependencies. Annex VII §2(b) requires the SBOM as part of the design and development documentation.

Export your existing SBOM

Use your CI/CD tools (Syft, CycloneDX, SPDX). CRACheck accepts your dependency data as input.

Complete the CRACheck questionnaire

15–25 minutes. CRACheck contextualises the SBOM within the Annex VII §2 section alongside CVD policy and secure update mechanism.

Download the 8-PDF dossier

The Technical Documentation PDF includes the SBOM in context. The CVD Policy PDF complements it.

Deliver to your EU client

The client receives the structured Annex VII package, not a raw JSON file. Their compliance team integrates it directly.

Update on each major release

Each significant change to dependencies warrants an SBOM update. Use your 10 regenerations within the 30-day licence window.

Three mistakes to avoid

❌

COMMON MISTAKE

"We already generate CycloneDX on every build — our SBOM is done"

CycloneDX or SPDX output is the raw material, not the deliverable. Annex VII §2(b) of Regulation (EU) 2024/2847 requires the SBOM as part of the technical documentation, alongside the coordinated vulnerability disclosure policy and evidence of secure update distribution. Sending a JSON file is like sending a spreadsheet instead of a financial report — the data is there but the structure is missing.

❌

COMMON MISTAKE

"The SBOM only needs to list direct dependencies"

Annex I Part II §1 of Regulation (EU) 2024/2847 specifies "covering at the very least the top-level dependencies." This means direct dependencies as a minimum — but market surveillance authorities may request deeper visibility. Best practice is to include transitive dependencies for security-critical components. CRACheck structures the SBOM section to reflect regulatory expectations.

❌

COMMON MISTAKE

"SBOM is optional under the CRA — the client is overreaching"

The SBOM is mandatory in two places: Annex I Part II §1 (vulnerability handling requirement) and Annex VII §2(b) (technical documentation content). Annex VII §8 adds that the SBOM must be provided to market surveillance authorities upon reasoned request. Your client is not overreaching — they are reading the regulation correctly.

What the ZIP contains

8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.

Product Classifier

Annex III/IV classification.

Technical Documentation

Annex VII with SBOM contextualised in §2(b). Design, development, and vulnerability handling documentation.

Risk Assessment

Art. 13(2). Cybersecurity risk assessment including supply chain risk from third-party dependencies identified in the SBOM.

User Information

Annex II. Includes vulnerability reporting contact and support period.

Declaration of Conformity

Art. 28 + Annex V.

CVD Policy

Annex I Part II §5. Coordinated vulnerability disclosure policy — the companion document to the SBOM.

Notification Template

Art. 14. ENISA notification for vulnerabilities discovered in SBOM components. Art. 14(2): early warning within 24h, notification within 72h, final report within 14 days.

Obligations Calendar

Key dates.

Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.

Generated from your data, in your browser. No data leaves your device.

What you pay

🧾 COMPLIANCE CONSULTANT TO STRUCTURE YOUR SBOM FOR CRA

€4,000–€8,000

3–6 weeks. To restructure data your pipeline already generates.

✓ CRACHECK

€149

8 documents. SBOM in Annex VII context. 15–25 minutes.

Two layers of responsibility

● WHAT CRACHECK DOES

Documentation generation

Structures your SBOM data within the Annex VII §2(b) framework. Generates the complete 8-document dossier. 15–25 minutes. €149.

∅ WHAT CRACHECK DOES NOT DO

What falls outside CRACheck

Does not scan your codebase for dependencies — use your existing CI/CD tools for that. Does not perform vulnerability analysis on SBOM components. Does not replace a software composition analysis (SCA) tool.

Your pipeline generates the raw data. CRACheck structures it for the regulation.

Enforcement regime

Article 64 of Regulation (EU) 2024/2847.

🇪🇺

Non-compliance with Annex I Part II (including SBOM) + Art. 13

€15M / 2.5%

Art. 64(2). Missing SBOM is a failure to comply with vulnerability handling requirements.

🇪🇺

Incomplete technical documentation (Art. 31 + Annex VII §2(b))

€10M / 2%

Art. 64(3).

🇪🇺

Incorrect information

€5M / 1%

Art. 64(4).

Alternatives

Alternative	Cost	What you get
Compliance consultant	€4,000–€8,000	SBOM structuring + regulatory context. 3–6 weeks.
Send raw CycloneDX/SPDX to client	Free	Client rejects it. Not Annex VII format.
Manually restructure SBOM into Annex VII	Free + engineering days	Custom format. No regulatory validation.
CRACheck	€149	8 documents. SBOM in Annex VII §2(b) context. 15–25 min.

Your team maintains SBOM for multiple products?

Each product requires its own Annex VII documentation with SBOM. If you manage 10+ products for EU clients, contact us for volume pricing.

Request Volume Pricing

One-business-day response

What CRACheck guarantees and what it does not

CRACheck generates a structured document under Article 31 and Annex VII of Regulation (EU) 2024/2847 from the information you provide. The accuracy and completeness of the SBOM data is your responsibility.

We guarantee the document structure follows Annex VII and the legal references are correct. We do not guarantee that the SBOM will satisfy a specific market surveillance authority request under Annex VII §8.

CRACheck is not legal advice. For questions about SBOM disclosure obligations under Annex VII §8, consult a qualified lawyer.

Frequently asked questions

What does the CRA require for SBOM specifically?

Two provisions. Annex I Part II §1 of Regulation (EU) 2024/2847 requires manufacturers to identify and document components by drawing up an SBOM in a commonly used and machine-readable format covering at the very least the top-level dependencies. Annex VII §2(b) requires the SBOM as part of the technical documentation alongside the CVD policy and evidence of secure update distribution. Annex VII §8 adds that the full SBOM must be available to market surveillance authorities upon reasoned request.

Which SBOM format does the CRA require?

Annex I Part II §1 specifies "commonly used and machine-readable format" without naming a specific standard. CycloneDX and SPDX are both widely accepted. The regulation does not mandate one over the other.

Is the SBOM made public?

No. Annex VII §8 states that the SBOM is provided to market surveillance authorities upon reasoned request — it is not published publicly. Your client keeps it in their conformity file. Authorities access it only when investigating a specific compliance question.

How deep does the SBOM need to go?

The regulation states "at the very least the top-level dependencies." Direct dependencies are the minimum. Best practice includes transitive dependencies for security-critical paths. CRACheck structures the SBOM section to reflect regulatory expectations without over-scoping.

Is it a subscription?

No. One-time payment. 30 days editing, 10 regenerations. PDF is yours.

Can I request a refund?

Art. 16(m) Directive (EU) 2011/83. Activation = express consent. Refunds only for reproducible technical failures.

What if the regulation changes?

Regenerate at no additional cost during your licence period.

Official legal sources

Regulation (EU) 2024/2847 — Cyber Resilience Act — full text

⚠️ Important notice: CRACheck is a self-assessment documentation tool, not legal advice and not a third-party audit. The document under Article 31 and Annex VII of Regulation (EU) 2024/2847 is generated from your input data. You are responsible for the accuracy of the data you provide. CRACheck does not replace a qualified professional assessment.

Key numbers

How it works

Three mistakes to avoid

"We already generate CycloneDX on every build — our SBOM is done"

"The SBOM only needs to list direct dependencies"

"SBOM is optional under the CRA — the client is overreaching"

What the ZIP contains

Product Classifier

Technical Documentation

Risk Assessment

User Information

Declaration of Conformity

CVD Policy

Notification Template

Obligations Calendar

What you pay

Two layers of responsibility

Documentation generation

What falls outside CRACheck

Enforcement regime

Alternatives

Your team maintains SBOM for multiple products?

What CRACheck guarantees and what it does not

Frequently asked questions

Official legal sources

Your client needs an SBOM inside Annex VII documentation. Generate the full dossier in 15 minutes.

Related landings

CRA compliance Indian IT company — EU client

CRA documentation Indian developer — EU contract clause

CRA technical documentation outsourced software India — EU