A registry per release
One SBOM for each product and release, fed from CI or from an upload.
CRA evidence
SBOM software and supplier evidence for the CRA
Answer "which of our shipped versions contain this component?" without searching folders, and stop chasing supplier SBOMs by email.
Checked against the regulation on 16 Oct 2026 · What changed
One fixed price, in writing, the same day you ask · a delivery date agreed in writing · about 4 hours of your engineers' time · the price only changes if the scope does.
NDA before anything sensitive · the drill runs on sample data · no production access · every document is yours.
Runs in your hosting · Fed from your CI · CycloneDX and SPDX
What the CRA asks
An SBOM is part of the technical file, and third-party components need due diligence.
Annex I asks for an SBOM covering at least top-level dependencies. It has to be machine-readable, part of the technical file, and available to authorities on request. Article 13 asks for due diligence on third-party components, including open source.
You need one per release. A file generated once and emailed around won't show which supplier SBOMs are missing. We connect to the scanner you already run.
What we build
A registry your CI can feed, a door for suppliers, and a search across what you have shipped.
A supplier portal
Suppliers send their SBOMs there. Missing and out-of-date ones are flagged.
Component search
Ask which shipped versions contain a component, and get the releases, not a folder of files.
Exports
Exports for customers and for authorities, from the same record.
Both formats
CycloneDX and SPDX, because the CRA has not named one yet.
A component question
Illustration
example-lib
- 1.4.2
- Supplier SBOM on file
- 1.4.1
- Supplier SBOM on file
- 1.3.0
- Supplier SBOM missing
In use
A component question has an answer in the registry.
A supplier warns you about a component. Search shows which releases contain it, which supplier SBOM is missing, and the export you would hand to an authority is the same record.
How it works
We connect to the scanner you have, then keep a bill of materials for each release.
Call
Whether you produce SBOMs today, and from where.
Brief
Products, releases, and which suppliers must send theirs.
Build
The registry, the portal and the search.
Launch
One product's releases, then the rest.
Handover
Code, docs and access are yours. We stay on call for 30 days.
What you get, and what we need
You get a record per release. We need the pipeline, or a person who can upload.
What you get
- An SBOM for every release you ship.
- CycloneDX and SPDX.
- A supplier portal with missing and stale flags.
- Search and exports from that record.
What we need from you
- The CI or scanner we connect to.
- The list of products and suppliers.
- How long each product is supported.
- Who may export a file for an authority.
Reporting: applies since 11 Sep 2026 · Everything else: 11 Dec 2027 · Full timeline
Related
Questions
Do you replace our scanner?
No. We connect to your scanner. We don't replace it.
Which formats do you support?
CycloneDX and SPDX. The CRA does not yet name a format, so the registry keeps both rather than betting on one.
Do we need an SBOM for every release?
Yes. The point of the registry is a bill of materials for each shipped version, so a later question about a component has a version to point at.
How long do we keep the records?
The registry is set up to keep every release for 10 years or the support period, whichever is longer.
Samisoftz builds the process and software your team uses to organise CRA evidence and reporting. You stay responsible for meeting the regulation. We don't give legal advice, act as a notified body, or submit reports for you.
On a delivery date agreed in writing, your team will know who decides, what to send at 24 and 72 hours, and will have practised it once on your own product. The decision to report stays with you. We set up how.
Could your team send a 24-hour early warning tomorrow? Find out in 30 minutes.
You'll talk to Usama, who'd build it.
30 minutes · no slides · a written answer if it's not a fit
One fixed price, in writing, the same day you ask · a delivery date agreed in writing · about 4 hours of your engineers' time · the price only changes if the scope does.
NDA before anything sensitive · the drill runs on sample data · no production access · every document is yours.