The CRA reporting clock is running. Generating an SBOM was never the hard part.

The EU Cyber Resilience Act (CRA) reporting clock began on September 11, 2026. Businesses that sell software in the EU must report specific information within 24-72 hours of an actively exploited vulnerability or severe incident being discovered, regardless of whether the product was released prior to the CRA's implementation date.

This includes a Security Baseline of Materials (SBOM), technical documentation, EU Declaration of Conformity, and a coordinated vulnerability disclosure (CVD) policy. Generating an SBOM is relatively straightforward, with existing tools like npm sbom, cyclonedx-npm, and syft providing a machine-readable file in a single command.

However, the real challenge lies in creating a comprehensive vulnerability-handling process, drafting a CVD policy, and submitting a draft Declaration of Conformity. While the SBOM itself is not a public artifact and is retained for market surveillance authorities, the CRA emphasizes the importance of having a clear vulnerability-handling approach and documenting risk-based decisions regarding the scope of the SBOM.

The ROSH Company Labs' cra-kit tool simplifies the SBOM generation process by providing a zero-dependency Node CLI that produces a CycloneDX 1.6 SBOM, along with supporting documentation such as a vulnerability-handling policy, CVD policy, and a readiness checklist. However, it is crucial to understand that the CRA reporting clock is already running, and the SBOM is just one component of the broader compliance requirements.

Building a robust vulnerability-handling process and creating a comprehensive Declaration of Conformity are equally important steps in ensuring CRA compliance.