EU CRA SBOM and Article 14 Reporting Obligations, Built Into SBOM Studio

The EU's first horizontal cybersecurity law for products with digital elements. It sets secure-by-design requirements, an SBOM obligation, and rules for reporting actively exploited vulnerabilities, and entered into force December 10, 2024.

Article 14 reporting obligations took effect on September 11, 2026 and are in force now. Since that date, actively exploited vulnerabilities and severe incidents must be reported to ENISA and your national CSIRT within 24 hours of becoming aware of them.

Manufacturers, importers, and distributors of connected products sold into the EU, regardless of where the company is based. Article 14 reporting also covers products already placed on the market, while the rest of the CRA reaches them only on substantial modification after December 11, 2027.

Penalties depend on which obligation is breached. Breaching the essential cybersecurity requirements in Annex I, including the SBOM and vulnerability handling requirements, or the manufacturer obligations in Articles 13 and 14, including Article 14 reporting, can bring fines of up to €15 million or, if the offender is an undertaking, up to 2.5% of its total worldwide annual turnover for the preceding financial year, whichever is higher. Breaches of other listed obligations, including those of importers and distributors, carry up to €10 million or 2% on the same basis. Supplying incorrect, incomplete or misleading information to notified bodies or market surveillance authorities in reply to a request carries up to €5 million or 1%, also on the same basis. This is not legal advice; confirm your exposure with counsel.

The provision requiring manufacturers to report actively exploited vulnerabilities and severe incidents, on a staged clock: a 24-hour early warning, a 72-hour full notification, and a final report within 14 days of a corrective or mitigating measure becoming available. Severe incidents run a separate clock, with a final report within one month of the notification.

Yes. The September 11, 2026 reporting obligation, in force since that date, applies to products already sold into the EU, not only new releases, well ahead of the full application date in December 2027.

A machine-readable inventory of the components in a software product. The CRA requires one covering at the very least the top-level dependencies, so you can tell within minutes whether a new vulnerability affects you, a prerequisite for the 24-hour clock. Formats, depth and per-version rules are in EU CRA SBOM requirements.

Yes. The same governed SBOM System of Record, continuous monitoring, and VEX generation that meet EU CRA obligations also support FDA Section 524B, IEC 62443, and other frameworks, so CRA readiness builds on infrastructure you can reuse elsewhere.