CLAIM-2026-08-06-07
The Cyber Resilience Act's Annex I Part II requires manufacturers to draw up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the product.
Why it matters
The regulatory hook. The SBOM duty enumerates dependencies, and the persistence artefact is not one, so compliance and security diverge here.
Sources
- europeancyb2022cyber