1.3 Note on the current version of the document

The current version of the document is released as a result of the ENISA call for feedback (4) which took place between the 17 th of December 2025 and the 23 rd of January 2026 and it is heavily influenced by the survey results presented at ENISA’s SBOM Adoption State of Play 2026 published on the 9 th of June 2026 (5). Via the call for feedback ENISA received 67 contributions from public and private stakeholders, cybersecurity experts, and the open-source community.

Based on this feedback and the survey results, ENISA recognised the need to transform the “ SBOM

Landscape Analysis: Towards an implementation guide ” into a “ Technical Advisory for Software

Bills of Materials ” to better respond to the needs and feedback of the ecosystem.

Finaly, this version also reflects the feedback provided by experts participating in the SBOM Workstrand under the CRA Expert Group as part of the review cycle conducted between 31 July and 11 September 2026.

Acknowledgements

We would like to publicly thank all stakeholders that provided their views and feedback! All

contributions have been reviewed and, to the maximum extent possible, the recommendations and observations have been addressed in this final version. This document may go through regular revisions.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

3. Related Regulations

• ENISA -