Vulnerability handling (Annex I, Part II)
This is where the SBOM becomes a legal obligation, and it is the part of Annex I that commits over time: it describes a process to run throughout the support period.
The eight obligations
1. Identify and document — the SBOM
Identify and document vulnerabilities and components contained in the product, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the product.
The detail is set out in What the CRA requires of the SBOM. Remember that “top-level” is a legal floor, and that the Commission may specify by implementing act the format and elements expected.
2. Address and remediate without delay
Address and remediate vulnerabilities without delay, including by providing security updates. Where technically feasible, security updates are provided separately from functionality updates.
That separation carries a heavy engineering consequence: it requires maintenance branches and backporting capability, hence a versioning strategy decided at design time. See Secure updates.
3. Test and review regularly
Apply effective and regular security tests and reviews. “Regular” implies a defined cadence that is actually kept, not a test at the release of a major version.
4. Publish information on fixed vulnerabilities
Once a security update is available, publicly disclose information about fixed vulnerabilities: description, identification of affected products, impacts, severity, and information helping users remediate.
In practice: security advisories published, ideally in CSAF 2.0 format, machine readable so your customers can process them automatically.
5. Put in place and enforce a CVD policy
Put in place and enforce a policy on coordinated vulnerability disclosure. Both verbs matter: a policy that is published but whose reports go unanswered does not satisfy the requirement. See Disclosure policy.
6. Facilitate information sharing
Take measures to facilitate the sharing of information about potential vulnerabilities in the product and in the third-party components it contains, including by providing a contact address.
7. Distribute updates securely
Provide for mechanisms to securely distribute updates, ensuring that vulnerabilities are fixed or mitigated in a timely manner and, where applicable for security fixes, in an automatic manner.
8. Distribute without delay and free of charge
Ensure that available fixes and updates are disseminated without delay and, except for tailor-made products between businesses where otherwise agreed, free of charge, accompanied by advisory messages telling users what action to take.
Frequently missed. Free security fixes are a rule, not a commercial option. Charging for a maintenance contract as a condition of access to security fixes during the support period is incompatible with this requirement.
Due diligence on third-party components
Two complementary obligations in Article 13 frame the use of components you do not write — including free ones:
- Due diligence on integration: assess the quality and maintenance of the component, check for known exploitable vulnerabilities, examine the security history, release frequency and licence. That diligence must be documented.
- Reporting upstream: where a vulnerability is identified in a component, including a free one, report it to the person or entity manufacturing or maintaining that component, fix it, and — where relevant — share the fix with the upstream project.
The evidence to build
| Obligation | Evidence artefact |
|---|---|
| 1 | Signed, archived SBOM per version |
| 2 | Timestamped handling log, intervals measured by severity, patch branches |
| 3 | Dated test reports, test plan, coverage |
| 4 | Published advisories, browsable history |
| 5 | Published CVD policy, register of reports received and their handling |
| 6 | Live contact address, security.txt, acknowledgements |
| 7 | Description of the mechanism, signing keys, update tests |
| 8 | Publication history, advisory messages, evidence of free-of-charge supply |