The software bill of materials for spare parts: why a circuit board is now a compliance document
The shift from hardware to software compliance
When a European service technician replaces a motor driver board in a Chinese-made robotic arm, the physical act is straightforward: unplug, unscrew, swap, test. But under the Cyber Resilience Act (CRA), that board is no longer just a hardware component. It carries firmware, and firmware is now a regulated digital element. The CRA, formally Regulation (EU) 2024/2847, requires manufacturers to provide a software bill of materials (SBOM) for products with digital elements. For spare parts, this means a simple circuit board can be a compliance document in its own right.
The practical consequence for after-sales networks is significant. A spare part that contains any programmable logic—from a microcontroller to a full system-on-module—must be traceable not only by its part number but by the exact software version, its dependencies, and its vulnerability status. This is not a bureaucratic extra; it is a legal obligation that affects how spare parts are sourced, stored, and installed.
What the CRA actually requires
The CRA, published in the Official Journal of the European Union on 23 October 2024, introduces harmonised rules for products with digital elements. Its scope includes ‘any software or hardware product and its remote data processing solutions, including software components that are placed on the market separately.’ Spare parts are not explicitly exempt. In fact, the regulation’s recitals clarify that components intended for integration into final products must meet the same essential requirements when they are placed on the market.
Article 13 of the CRA sets out the obligations for manufacturers, including the duty to ‘identify and document vulnerabilities and components, including by drawing up a software bill of materials.’ The SBOM must include the ‘the supply chain relationships of the product, the components included in the product, and the vulnerabilities to which the product may be subject.’ This is not a one-time document; it must be kept up to date for the support period, which is typically at least five years after the product is placed on the market.
For a spare part like a control board, the manufacturer (or the importer, if the manufacturer is outside the EU) must provide an SBOM that covers the firmware installed on that board. This includes the firmware version, the open-source libraries used, and any known vulnerabilities. The SBOM must be made available to the market surveillance authorities upon request, and in practice, it is also shared with downstream business users to enable them to assess and manage risks.
Why a circuit board is now a compliance document
Consider a typical scenario: a Chinese robotics manufacturer ships a collaborative robot to a European integrator. The robot’s main controller board contains firmware that handles safety functions, communication protocols, and motion control. When that board fails, the after-sales network orders a replacement. Under the CRA, the replacement board is a ‘product with digital elements’ in its own right. It must have its own SBOM, not just the SBOM of the complete robot.
This matters because the firmware on the replacement board may differ from the original. It could have a security patch, a bug fix, or a new feature. The SBOM for the spare part must reflect that specific firmware version. If the after-sales network installs a board with an outdated or vulnerable firmware, it could create a security gap that the manufacturer is liable for. The SBOM is the document that proves the part is compliant and traceable.
Moreover, the CRA requires that vulnerabilities in the product are handled throughout the support period. If a vulnerability is discovered in a firmware component, the manufacturer must issue a security update. The after-sales network must be able to identify which spare parts are affected, which requires a precise SBOM for each part. Without it, the network cannot effectively manage recalls or patches.
Hardware part vs. firmware-bearing part: a compliance comparison
| Aspect | Hardware-only spare part (e.g., bracket, gear) | Firmware-bearing spare part (e.g., control board) |
|---|---|---|
| Regulatory classification | Not a product with digital elements; no SBOM required | Product with digital elements; SBOM mandatory |
| Documentation needed | Declaration of conformity (if applicable), material datasheet | Declaration of conformity, SBOM, vulnerability disclosure |
| Traceability | Part number, batch number | Part number, firmware version, SBOM hash |
| Vulnerability management | Not applicable | Must be monitored and patched during support period |
| Market surveillance risk | Low; mainly physical safety | High; non-compliance can lead to fines and product recalls |
| Impact on after-sales | Simple stock management | Requires software version control and update procedures |
How to build an SBOM for a spare part
Building an SBOM for a spare part is not as daunting as it may seem, but it requires a systematic approach. The European Commission’s guidance on the CRA (available on the digital-strategy website) emphasises that the SBOM should be machine-readable and follow a standard format, such as SPDX or CycloneDX. Here is a step-by-step process that a service network can use:
- Identify the firmware-bearing components: For each spare part, determine if it contains any programmable logic. This includes microcontrollers, FPGAs, and any module with embedded software.
- Inventory the software components: For each firmware-bearing part, list all software components, including the operating system (if any), libraries, and third-party modules. This is the core of the SBOM.
- Record version and provenance: For each component, note the exact version, the supplier, and the license. This information is essential for vulnerability tracking.
- Generate the SBOM in a standard format: Use a tool to generate an SBOM in SPDX or CycloneDX format. This can be done by the manufacturer, but the after-sales network should request it and verify its accuracy.
- Establish a vulnerability monitoring process: The SBOM is only useful if it is kept up to date. Subscribe to vulnerability databases (e.g., NVD) and track advisories for the components listed.
- Integrate SBOM into inventory management: Link each spare part’s SBOM to its stock keeping unit (SKU) in the inventory system. This allows the network to quickly identify which parts are affected by a new vulnerability.
Practical implications for after-sales networks
For a service network like the one being set up in Europe, the CRA changes the way spare parts are handled. It is no longer enough to stock a replacement board; the network must also have the corresponding SBOM and be able to update the firmware if needed. This requires close cooperation with the manufacturer to obtain accurate SBOMs and to receive security updates in a timely manner.
One of the challenges is that many Chinese manufacturers may not yet have SBOMs for their components. The after-sales network must therefore push for this documentation as part of the procurement process. It may also need to help manufacturers understand the requirements, as the CRA applies to any product placed on the EU market, regardless of where the manufacturer is based.
Another implication is the need for technical expertise. The network’s technicians must be trained to handle firmware updates and to verify that the installed firmware matches the SBOM. This is a new skill set that goes beyond traditional hardware repair.
Honest caveats: what varies and what to verify
It is important to note that the CRA is a regulation, not a directive, so it applies uniformly across EU member states. However, the enforcement and penalties can vary by country, as national authorities are responsible for market surveillance. The CRA sets maximum fines (up to €15 million or 2.5% of global turnover, whichever is higher), but the actual enforcement may differ.
Also, the CRA has transitional periods. It entered into force on 11 December 2024, but most obligations apply from 11 December 2027. This gives manufacturers and service networks time to prepare, but it is wise to start early, especially for spare parts that are already in the supply chain.
Finally, the exact format and content of the SBOM are not fully specified in the regulation. The European Commission is expected to issue implementing acts and guidance, but until then, it is advisable to follow the common standards (SPDX, CycloneDX) and to align with the requirements of the market surveillance authorities.
Conclusion
The Cyber Resilience Act turns a simple circuit board into a compliance document. For after-sales networks, this is both a challenge and an opportunity. By embracing SBOMs, the network can offer a higher level of service, ensuring that every spare part is not only functional but also secure and compliant. The key is to build the processes now, before the obligations become fully enforceable.
Sources
- EUR-Lex — Regulation (EU) 2024/2847 — https://eur-lex.europa.eu/eli/reg/2024/2847/oj (accessed 2026-03-24)
- European Commission — Cyber Resilience Act — https://digital-strategy.ec.europa.eu/ (accessed 2026-03-24)