
Shipping Software in the EU Now Requires Proving How You Built It
The CRA’s 24-hour reporting clock went live on September 11. An SBOM tells a regulator what’s in a product, not why it’s there, and that’s exactly what the 72-hour notification and final report are built to ask.








