RESOURCES · GUIDE

SBOM Requirements in 2026: Who Actually Has to Provide One?

'Everyone requires SBOMs now' is an oversimplification. The real picture is a set of distinct regulations with different scopes, timelines and obligations. Here is what applies to whom.

United States: EO 14028 and federal procurement

Executive Order 14028 (2021) directed federal agencies to require software supply chain transparency from their suppliers. The practical consequence: if you sell software to the US federal government, SBOM delivery and secure-development attestation are procurement requirements. CISA continues to publish SBOM guidance and minimum-element refinements. This is a procurement obligation — it binds vendors to federal buyers, not the private market in general.

European Union: the Cyber Resilience Act

The CRA applies to "products with digital elements" placed on the EU market — hardware and software alike. It requires manufacturers to maintain an SBOM covering at least top-level dependencies, handle vulnerabilities throughout the product lifecycle, and report actively exploited vulnerabilities. Main obligations phase in through 2026–2027. Unlike EO 14028, the CRA is market-access law: it applies to anyone selling into the EU, regardless of who the buyer is. See our full CRA compliance guide.

Medical devices: FDA

The FDA requires an SBOM in premarket submissions for cyber devices under section 524B of the FD&C Act. Device makers must also demonstrate a vulnerability-management process across the device lifecycle. Details in our medical device SBOM guide.

Beyond regulation: customer-driven requirements

In practice, the fastest-growing source of SBOM demand is not regulators but customers: enterprise procurement teams, automotive OEMs, and financial institutions increasingly write SBOM delivery into contracts. Suppliers who can produce a current, accurate SBOM on request turn a compliance burden into a trust signal.

How to prepare

• Generate in CI, not at release. A hand-assembled SBOM drifts from reality immediately. Embed generation in every build.
• Cover the full stack. Source-level dependencies plus container layers plus — for embedded products — binary components with no source available.
• Pair with VEX. An SBOM says what you contain; a VEX statement says which vulnerabilities actually affect you. Together they cut your customers' triage cost dramatically.

SCA tooling is the engine behind all three: identification, generation, and continuous verification.

FAQ

What is the NTIA minimum elements baseline?

Seven data fields the US NTIA defined as the floor for a useful SBOM: supplier, component name, version, unique identifiers, dependency relationships, SBOM author, and timestamp. Most regulations reference this baseline.

Which format should we use — SPDX or CycloneDX?

Both are accepted almost everywhere. SPDX (ISO/IEC 5962) is stronger in license compliance contexts; CycloneDX is security-tool native. Pick based on what your customers request; good tooling exports both.