What the EU Cyber Resilience Act's SBOM Requirement Actually Means If You Ship Containers to the Cloud

EU Cyber Resilience Act, Regulation (EU) 2024/2847, requires manufacturers of products with digital elements to maintain a machine-readable software bill of materials (SBOM) covering at least direct dependencies, with full requirements taking effect on 11 December 2027, while vulnerability and severe-incident reporting begins on 11 September 2026. The SBOM does not need to be public but must be retained in technical documentation, available to market-surveillance authorities on request, and kept for at least 10 years or the product’s support period, whichever is longer. Pure multi-tenant SaaS is generally governed by NIS2 rather than the CRA, but companies distributing container images, Helm charts, agents, CLIs, self-hosted software, or embedded software are considered manufacturers and must comply. For containerized products, the recommended approach is to pin base images by immutable digest, generate SPDX or CycloneDX SBOMs during builds, attach signed attestations to image digests, track transitive dependencies, and use VEX statements to clarify actual vulnerability exposure. Cloud providers such as AWS, Google Cloud, Azure, and Scaleway remain responsible for infrastructure and managed control planes, while customers retain responsibility for application images, dependencies, SBOMs, security updates, documentation, CE conformity processes, and reporting to ENISA and national CSIRTs. Noncompliance with core CRA obligations may result in penalties of up to €15 million or 2.5% of global annual turnover, and the article recommends integrating artifact inventory, vulnerability triage, signed build attestations, admission controls, and long-term retention into standardized CI/CD workflows.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.