Cyber Resilience Act: ENISA's new guidance on SBOMs and secure updates
ENISA published technical advisories on software bills of materials (22 October) and secure update mechanisms (4 November) for CRA manufacturers.
The EU Agency for Cybersecurity (ENISA) published a Technical Advisory for Software Bill of Materials on 22 October 2026 and a Technical Advisory on Secure Update Mechanisms on 4 November 2026. Both are written for manufacturers under the Cyber Resilience Act (CRA), especially small and medium-sized ones. They are guidance, not law, and give no presumption of conformity.
What changed
The CRA requires an SBOM in a commonly used, machine-readable format covering at least the top-level dependencies, and a market surveillance authority can ask for it (Annex I, Part II and Annex VII). Security updates must be distributed securely, without delay and free of charge, where feasible separately from feature updates. ENISA now shows how to do this in practice:
- SBOMs: use CycloneDX or SPDX, generate an SBOM for every build, then validate, sign, store and maintain it. Keep evidence for audits and authority requests, and record the gaps in your SBOM coverage.
- Updates: sign update metadata and protect the keys, accept updates only from trusted sources over encrypted connections, and reject outdated or replayed metadata. Install security updates automatically by default where possible, and publish clear advisories with each fix.
Key dates
- 11 September 2026: reporting of actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform already applies. Joint EU statements on critical PHP vulnerabilities (21 October) and on incidents hitting refrigeration systems (4 November) reminded manufacturers of this.
- 11 December 2027: the CRA applies in full, including SBOMs, secure updates and a support period of at least five years unless the product is expected to be in use for less time (Article 13(8)).
More on reporting: Cyber Resilience Act: reporting is live, the rest follows in 2027.
What to do now
List your products in scope, produce an SBOM for each release and check who can sign an update and how devices verify it. Dazr Compliance keeps this in one CRA module: product classification, SBOM upload in CycloneDX or SPDX JSON with a known-vulnerability check, Article 14 reporting clocks and Annex VII technical documentation.
Sources
- ENISA: Technical Advisory for Software Bill of Materials (22 October 2026)
- ENISA: Technical Advisory on Secure Update Mechanisms (4 November 2026)
- Regulation (EU) 2024/2847 (Cyber Resilience Act), Articles 13 and 71, Annexes I and VII
- European Commission: Joint statement on critical PHP vulnerabilities (21 October 2026)
- European Commission: Joint statement on cyber incidents in refrigeration systems across the EU (4 November 2026)
For information only, not legal advice. Last updated 7 November 2026.
Also available in: Nederlands, Italiano, Deutsch, Français, Español, Polski, Português, Română, Čeština, Slovenčina, Dansk, Svenska, Norsk bokmål