The EU Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, requires manufacturers of products with digital elements to maintain cybersecurity across the lifecycle, including machine-readable software bills of materials (SBOMs) in technical documentation. AI SaaS vendors often assume cloud exemptions cover every inference API, yet many ship desktop agents, edge models, firmware, SDKs, or remote data processing tied to hardware products that clearly fall in scope. Commission guidance published in July 2026 clarified remote data processing boundaries, making SBOM planning urgent for AI application vendors serving European customers.
CRA SBOM AI SaaS compliance starts with scope analysis, not SPDX file generation. Pure standalone SaaS developed outside a manufacturer's product responsibility generally falls under NIS2 rather than CRA product rules, but AI backends that control smart devices, medical appliances, or industrial edge systems may qualify as remote data processing solutions subject to SBOM and vulnerability reporting. Review obligations alongside AI code and devops tooling and cybersecurity resources before customer contracts promise CRA-ready documentation.
CRA Applicability to AI SaaS Vendors
The CRA covers products with digital elements placed on the EU market, including standalone software and remote data processing solutions integral to those products, while pure websites and standalone SaaS outside manufacturer responsibility generally do not. Recital 12 and official CRA FAQ text distinguish cloud services designed for a manufacturer's product, such as a smart home backend, from generic SaaS platforms. An AI copilot sold only through a browser with no tied hardware may sit outside CRA product rules but still face NIS2 if the provider qualifies as an important digital service.
AI vendors commonly trigger CRA relevance when they ship:
- On-prem inference appliances or edge LLM bundles with auto-update channels.
- Agent frameworks distributed as versioned binaries with remote tool execution.
- Firmware or embedded models in IoT, automotive, or medical devices.
- SDKs and IDE plugins that update automatically and connect to vendor cloud.
- Remote data processing that enables core functions of a hardware product sold in the EU.
July 2026 Commission guidance (document C(2026) 5252) addressed scope questions for microenterprises and SMEs, remote data processing, free and open-source software, and interplay with other EU legislation. AI SaaS legal teams should map each SKU separately because a browser-only tier and an edge appliance tier in the same product family can face different regimes.
SBOM Content Requirements for AI Products
Manufacturers must generate a machine-readable SBOM covering at least top-level software dependencies, keep it current through updates, and include it in technical documentation available to market surveillance authorities on request. The CRA does not require public SBOM publication, but authorities may request SBOMs during investigations, and ADCO can coordinate Union dependency assessments using anonymized aggregated dependency data.
Minimum SBOM elements for AI application vendors include:
- Product name, version, and release identifier tied to shipped artifacts.
- Top-level dependencies: inference runtimes, model serving frameworks, container base images.
- Component identifiers in SPDX, CycloneDX, or SWID format.
- Supplier and license metadata for third-party ML libraries and CUDA stacks.
- Update history linking patches to SBOM revisions.
| SBOM element | AI SaaS example | Common gap |
|---|---|---|
| Top-level dependencies | vLLM, PyTorch, nginx, OS base image | Listing only Python packages, not container layers |
| Machine-readable format | CycloneDX JSON exported from CI | Static spreadsheet updated manually once a year |
| Technical documentation | Annex VII file with architecture diagram | SBOM stored in engineering wiki without retention policy |
| Currency | Regenerated on every production release | Drift between declared and deployed dependencies |
Build SBOMs from what actually ships, not declared dependency files alone. AI stacks often pull model weights, CUDA drivers, and sidecar containers that do not appear in application package manifests. Annex VII technical files also require cybersecurity risk assessments, vulnerability handling evidence, and support period definitions retained for at least ten years.
Vulnerability Disclosure Process Under CRA
Article 14 reporting obligations apply to all in-scope products regardless of placement date, requiring notification of actively exploited vulnerabilities and severe incidents through the EU Single Reporting Platform. Enforcement began September 11, 2026, more than a year before full SBOM and CE marking duties on December 11, 2027. AI vendors must therefore operate coordinated vulnerability disclosure even while SBOM programs mature.
A CRA-aligned disclosure program includes:
- Published security contact and coordinated disclosure policy.
- Internal severity classification aligned with CRA incident definitions.
- Playbooks for notifying ENISA and market surveillance authorities within required timelines.
- Customer communication templates for patches affecting model serving or agent tools.
- Integration with SBOM data to assess blast radius when a dependency CVE lands.
AI-specific vulnerabilities span prompt injection in agent frameworks, unsafe tool execution defaults, and supply chain issues in popular ML packages. Document how security updates reach edge appliances versus cloud-only tenants because support obligations differ by deployment model.
Customer Contract Language for SBOM and CRA
Enterprise procurement teams increasingly ask AI SaaS vendors to warrant CRA readiness, provide SBOM access under NDA, and describe vulnerability notification SLAs even when the vendor believes NIS2 is the primary regime. Contracts should accurately describe scope rather than over-promise blanket CRA compliance for pure cloud tiers.
Recommended contract clauses address:
- Product scope: which SKUs are CRA in-scope products with digital elements.
- SBOM delivery: format, update cadence, and authority request procedures.
- Incident notification: timelines mirroring Article 14 where applicable.
- Subprocessor and open-source stewardship for embedded components.
- Support period and security update commitment through end of life.
Avoid copying EU AI Act conformity language into CRA sections without legal review. High-risk AI systems may need both AI Act technical documentation and CRA cybersecurity files. Customers comparing vendors should ask for sample Annex VII tables and evidence of automated SBOM generation in CI pipelines, not marketing PDFs alone.
SBOM Implementation Roadmap for AI Vendors
Teams should treat December 11, 2027 as a hard documentation deadline while using September 2026 through 2027 to automate SBOM generation, close dependency drift, and train customer success on disclosure playbooks.
| Phase | Actions | Target |
|---|---|---|
| Scope mapping | Classify each SKU: CRA product, remote data processing, or NIS2-only | Q4 2026 |
| Pipeline integration | Generate CycloneDX or SPDX on every release artifact | H1 2027 |
| Documentation bundle | Assemble Annex VII technical file per in-scope product | H2 2027 |
| Customer enablement | Publish contract exhibits and authority response procedures | Before December 2027 |
Frequently Asked Questions
Does pure browser SaaS need a CRA SBOM?
Standalone SaaS developed outside responsibility for a manufacturer's product is generally not a product with digital elements under CRA Recital 12. If the same vendor ships edge agents or device backends, those SKUs may still require SBOMs. Scope analysis per product line is essential.
Must SBOMs be public?
No. The CRA requires SBOMs in technical documentation provided to market surveillance authorities on request. Many vendors share SBOMs under NDA with enterprise customers even when public disclosure is optional.
Which SBOM format should AI vendors use?
SPDX, CycloneDX, and SWID are commonly accepted machine-readable formats. Pick one standard, automate generation in CI, and monitor Commission guidance for any additional format specifications.
When do SBOM obligations fully apply?
Full conformity obligations including SBOM in technical documentation apply December 11, 2027. Article 14 vulnerability reporting applies earlier, including to products placed on market before that date.
How does CRA SBOM relate to NIS2 for AI SaaS?
NIS2 governs security of important digital services and supply chains for qualifying cloud providers. CRA governs cybersecurity of products with digital elements. Many AI vendors will face one or both depending on SKU mix. Map obligations separately rather than assuming one certification covers all deployments. Explore AI development tools and cybersecurity compliance guides for overlapping control frameworks.
