{
  "id": 15658562,
  "title": "The CRA reporting clock is running. Generating an SBOM was never the hard part.",
  "url": "https://urgent.news/2026/10/19/the-cra-reporting-clock-is-running-generating-an-sbom-was-never-the",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-19T21:47:05.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/roshcompanylabs/the-cra-reporting-clock-is-running-generating-an-sbom-was-never-the-hard-part-5d28"
  },
  "original_language": "en",
  "account": "The EU Cyber Resilience Act (CRA) reporting clock began on September 11, 2026. Businesses that sell software in the EU must report specific information within 24-72 hours of an actively exploited vulnerability or severe incident being discovered, regardless of whether the product was released prior to the CRA's implementation date. This includes a Security Baseline of Materials (SBOM), technical documentation, EU Declaration of Conformity, and a coordinated vulnerability disclosure (CVD) policy. Generating an SBOM is relatively straightforward, with existing tools like npm sbom, cyclonedx-npm, and syft providing a machine-readable file in a single command. However, the real challenge lies in creating a comprehensive vulnerability-handling process, drafting a CVD policy, and submitting a draft Declaration of Conformity. While the SBOM itself is not a public artifact and is retained for market surveillance authorities, the CRA emphasizes the importance of having a clear vulnerability-handling approach and documenting risk-based decisions regarding the scope of the SBOM. The ROSH Company Labs' cra-kit tool simplifies the SBOM generation process by providing a zero-dependency Node CLI that produces a CycloneDX 1.6 SBOM, along with supporting documentation such as a vulnerability-handling policy, CVD policy, and a readiness checklist. However, it is crucial to understand that the CRA reporting clock is already running, and the SBOM is just one component of the broader compliance requirements. Building a robust vulnerability-handling process and creating a comprehensive Declaration of Conformity are equally important steps in ensuring CRA compliance.",
  "summary": "The reporting clock under the EU Cyber Resilience Act (Regulation (EU) 2024/2847) started on 11 September 2026 . If you put software on the EU market you are already inside Article 14: an actively exploited vulnerability, or a severe incident, has to reach a national CSIRT and ENISA through a single reporting platform on a 24-hour / 72-hour / final-report cadence — no transition period, and…",
  "key_points": [
    "EU Cyber Resilience Act reporting clock started September 11, 2026",
    "SBOM generation easy with existing tools like npm sbom",
    "Real challenge lies in vulnerability-handling process and CVD policy"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}