SBOM Field Check - CycloneDX and SPDX against the CRA 2026 bar

Five required fields are missing from the CycloneDX file below, and every SBOM viewer renders it without a word of complaint - which becomes a problem for any EU-market release engineer on 11 September 2026.

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.4",
  "components": [
    { "type": "library", "name": "left-pad", "version": "1.3.0" },
    { "type": "library", "name": "lodash" },
    { "type": "library", "name": "express", "version": "unknown" }
  ]
}

Paste that into SBOM Field Check and you get back, among other findings:

1: Spec version below the bar: BSI TR-03183-2 accepts CycloneDX 1.6+ or SPDX 3.0.1+ only - found: 1.4
1: No dependencies[] at all: the CRA requires the SBOM to cover at least the top-level dependencies
5: Component Producer absent (no supplier, manufacturer, author or publisher) - 3 of 3 (e.g. left-pad, lodash, express)
5: Component Hash absent: BSI TR-03183-2 requires a SHA-512 of the deployable component - 3 of 3
6: Component Version absent - 1 of 3 (e.g. lodash)

The two dates that get collapsed into one

Ask a chat assistant when the CRA needs your SBOM and you will usually get one date. There are two, and they do different jobs.

The Cyber Resilience Act entered into force on 10 December 2024. Its main obligations - including the software bill of materials inside the technical documentation - apply from 11 December 2027. But the reporting obligations start earlier, on 11 September 2026: from that day a manufacturer must send an early warning about an actively exploited vulnerability within 24 hours, a full notification within 72 hours, and a final report within 14 days of a corrective measure being available. Reporting goes through the CRA Single Reporting Platform to the CSIRT of your main establishment, and in parallel to ENISA.

That is why the 2026 date, not the 2027 one, is the one that bites. Nobody is going to audit your technical documentation next week. But a CVE lands in a transitive dependency, and you have twenty-four hours to say whether you ship it. You cannot answer that from an SBOM whose components have no purl, no version and no supplier - and an SBOM in that state renders perfectly in every viewer on the market.

What the bar actually is

Two documents define the field list, and neither is vague about versions.

BSI TR-03183-2 accepts CycloneDX 1.6 or higher or SPDX 3.0.1 or higher. SPDX 2.3 and CycloneDX 1.4 - the defaults that most generators still emit - do not qualify. Per component it requires name, version, creator, filename, dependencies resolved recursively, distribution licences, and a SHA-512 of the deployable component, plus the executable, archive and structured properties.

The CISA 2026 minimum elements define 23 elements in three groups: nine SBOM metadata fields, eight component data fields, and six practices and processes. The metadata group is the one teams forget: author, timestamp, tool name, tool version, generation context, data format name and version, document version, and a signature.

What the free version does

It reads the open bom.json or sbom.spdx.json, runs 34 rules over it, and names every gap - document level and component level, with counts and example component names. CycloneDX 1.x, SPDX 2.x JSON, SPDX 3.x JSON-LD and tag-value .spdx files all work. It runs entirely offline; the file never leaves the machine, which matters because an SBOM is a map of everything you ship.

When the file is clean it says so and stops. There is no watermark, no counter, and no locked answer.

What a licence adds

A different axis, not a bigger portion of the same one. Free finishes one file. A licence adds the whole workspace in one pass, an evidence file you keep (CSV, JSON or HTML) to file with your technical documentation, machine-readable CI output so a pipeline fails the build before the release leaves, and a re-check every time your generator rewrites the SBOM.

Published CRA cost calculators price this work at EUR 45/hour, and a documented readiness pass for one product family at EUR 12,000-25,000 of internal engineering time. A one-time $29 licence sits next to that number.