- Audience: manufacturers who have to document the components in their products; buyers who ask suppliers for an SBOM come second (FAQ).
- Angle: an SBOM produced by an independent rebuild of the deposit describes what actually builds, not what someone documented at launch.
- Hero mock: the same example product as the CRA overview (Gateway Controller, Release 4.2, run #7, 286 components), so the CRA pages read as one story. Example values only. The "changed since run #7" row is the confirmed monitoring between runs.
- Not claimed: an SBOM format, CRA conformity of the SBOM, any retention period, SBOM generation between rebuilds, and production's "live in 24 hours".
- 16 Oct: Continuity Pro added; base Continuity no longer includes Agentic Verification, so the SBOM line names Escrow Pro, Resilience Pro and Continuity Pro.
An SBOM of what you ship. Produced by a real rebuild.
The Cyber Resilience Act asks manufacturers to document the components in their products, including in a software bill of materials. With Agentic Verification, every successful rebuild of your deposit produces an SBOM of what was built, with build steps and a dated Recoverability Certificate.
Escrow Pro from $449. Per application per month. The SBOM comes with Escrow Pro, Resilience Pro and Continuity Pro.
- Trusted by 3,500+ teams
- ISO/IEC 27001:2022 certified
- A fresh SBOM with every rebuild
Trusted by 3,500+ teams, from regulated enterprises to fast-growing software vendors
- Left out: production's "covering at least the top-level dependencies" and "a PDF or spreadsheet does not meet the machine-readable requirement". Both paraphrase Annex I, which we couldn't verify. Also left out: the fines (€15M or 2.5%, €5M or 1%), which sit in Article 64, and the 24-hour, 72-hour and 14-day reporting windows, which we didn't verify and which aren't what this product does.
- Lead sentence: "documents the components … including in a software bill of materials" is a label paraphrase of recital 77, checked on EUR-Lex. It isn't presented as a quote.
What the CRA asks
The components in your product, on record.
The CRA puts the software bill of materials in Annex I, Part II, point (1), with the vulnerability handling requirements. These are the provisions around it.
“a formal record containing details and supply chain relationships of components included in the software elements of a product with digital elements”
“The Commission may, by means of implementing acts taking into account European or international standards and best practices, specify the format and elements of the software bill of materials referred to in Part II, point (1), of Annex I.”
“Manufacturers shall ensure, when placing a product with digital elements on the market, and for the support period, that vulnerabilities of that product, including its components, are handled effectively and in accordance with the essential cybersecurity requirements set out in Part II of Annex I.”
“… market surveillance authorities may request manufacturers of such categories of products with digital elements to provide the relevant software bills of materials as referred to in Part II, point (1), of Annex I.”
Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide.
In practice
An SBOM is as current as the last build behind it.
Every release adds code and dependencies. A file generated at launch describes launch. Over a support period measured in years, the record has to keep pace with what you ship.
An SBOM generated once
- Produced at release, then filed
- Generated by the same pipeline it describes
- Nobody has checked the product builds from what's listed
- No signal when the code moves on
An SBOM from each rebuild
- Produced by every successful rebuild of the deposit
- Rebuilt in the Codekeeper AI Verification Lab, with no help from your team
- Missing items flagged, so the deposit is completed
- Changes in your repositories flagged, so you know when to rebuild
- Confirm before launch: which SBOM format the product exports (for example SPDX or CycloneDX) and whether it covers what Annex I, Part II, point (1) asks for. Until then the page says "an SBOM" and claims no format.
- Confirm: swap the example SBOM rows for components from the anonymised real run (already in to-confirm.md), so they don't imply stack support.
How it works
From the deposit to an SBOM you can hand over.
Deposit the product
Connect your repositories once and deposits sync daily through 50+ integrations. Include the build scripts and the private or licensed packages the build needs.
Rebuild it, sealed off
AI agents work out how the product is built and rebuild it in the Codekeeper AI Verification Lab, cut off from the open internet, on supported technology stacks. In hours, not weeks.
Get the SBOM, with the proof
A successful rebuild produces an SBOM of what was built, with build steps, an Exit workbook, a deployable copy and a dated Recoverability Certificate.
Know when to rebuild
Between runs, we compare the deposit with your live repositories and flag what changed. Four rebuilds a year are included, started when you choose.
| Component | Version | Type | Licence |
|---|---|---|---|
| openssl | 3.0.13 | Library | Apache-2.0 |
| mbedtls | 3.6.0 | Library | Apache-2.0 |
| lwip | 2.2.0 | Library | BSD-3-Clause |
| freertos-kernel | 11.1.0 | Library | MIT |
| gw-protocol | 2.4.1 | Private package | Proprietary |
| sensor-hal | 5.0.3 | Licensed component | Commercial |
- Confirm before launch: whether "12 rebuilds a year, $299 a month more" is per application (already in to-confirm.md).
- 16 Oct: Continuity Pro added; base Continuity no longer includes Agentic Verification or the SBOM, so the third card is now Continuity Pro (from $1,699, 11 Oct list) and base Continuity ($1,449) moves to the note with the other base levels. The card's line "Full continuity, proven in advance" is the Continuity Pro line (confirmed by Danny on 16 Oct). The note gains the agreed closing sentence of the price logic.
Choose the level
An SBOM with every Pro plan.
All three rebuild the deposit and produce the SBOM. The difference is what your customers get if you can't support the product.
Escrow Pro
From$449per application per month
Everything you need to recover.
- Custody of the deposit by a neutral party
- 4 rebuilds a year, on supported technology stacks
- SBOM, build steps, Exit workbook and a deployable copy
- Recoverability Certificate
Resilience Pro
From$649per application per month
Proven before we need it.
- The deposit comes to Codekeeper and we run the recovery
- 4 rebuilds a year, on supported technology stacks
- SBOM, build steps, Exit workbook and a deployable copy
- Recoverability Certificate
Continuity Pro
From$1,699per application per month
Full continuity, proven in advance.
- Everything in Resilience Pro, SBOM included
- The live environment mapped at setup and kept current
- Kept paid and switched on for an agreed period while we recover
- Bills recharged at cost
Prices for software applications; SaaS and AI have their own rows. Setup $499 per arrangement, $999 for Continuity and Continuity Pro. Escrow, Resilience and Continuity, from $199, $399 and $1,449, hold the deposit with an automated check, a vault report and a Software Resilience Certificate; the SBOM comes with the rebuilds. Need fresh SBOMs more often? 12 rebuilds a year instead of four, for $299 a month more. Escrow means the deposit is released to you and you run the recovery. Resilience costs more because we do the recovery. Continuity costs more again because we also keep the live environment switched on. At every protection, Pro adds Agentic Verification. See full pricing
Sample evidence pack
See what your auditor would receive.
An anonymised set of outputs from a real Agentic Verification run, so you can judge the evidence before you talk to us.
- Recoverability Certificate
- Run report
- SBOM and Exit workbook excerpts
- "What format does the CRA require?" claimed our output is "the standard a market surveillance authority accepts". Replaced with Article 13(24) and the same caution as the CRA overview.
- "Does the SBOM have to be public?" now rests on recital 77, paraphrased, not quoted: the fetch tool's copy wrote "SBOM" where we'd expect the term spelled out, so legal should check the exact wording before it's ever quoted.
- "How long must an SBOM be kept?" claimed our "immutable vault covers the full retention window". Retention of earlier deposits and run outputs isn't confirmed (to-confirm.md), so the answer says what Article 13(13) asks and claims nothing about how long we keep anything. Whether the SBOM forms part of the technical documentation depends on Annex VII, which we couldn't read.
- The fines answer is gone (Article 64 not verified). Dates match the CRA overview (European Commission page, last updated 7 Sep 2026).
- Confirm before launch: the buyer answer says a beneficiary under Escrow Pro gets the SBOM and Recoverability Certificate from each rebuild, as the DORA page implies. Check with product which run outputs the beneficiary sees.
Questions
Before you hand over an SBOM.
Does the CRA require an SBOM?
Yes. Article 13(24) refers to “the software bill of materials referred to in Part II, point (1), of Annex I”. Part II holds the vulnerability handling requirements, which Article 13(8) asks manufacturers to meet for the whole support period. Recital 77 explains the purpose: identifying and documenting components to make vulnerability analysis easier.
Which format does the SBOM have to be in?
Under Article 13(24), the Commission may specify the format and elements of the SBOM by implementing acts, taking into account European or international standards and best practices. Check yours against the current rules with your assessor. Every successful rebuild produces an SBOM of what was built, and the sample evidence pack includes an excerpt.
Does the SBOM have to be public?
No. Recital 77 says manufacturers should not be obliged to make it public. Authorities can ask for it: under Article 13(25), market surveillance authorities may request SBOMs for a Union-wide dependency assessment, and under Article 13(22) they can make a reasoned request for the documentation that demonstrates conformity.
How is this different from an SBOM generator?
A generator lists what it finds in your repository or your own build. Agentic Verification rebuilds the product from the deposit, in the Codekeeper AI Verification Lab with no help from your team, and produces the SBOM from that rebuild, together with build steps and a Recoverability Certificate. Keep your generator: the rebuild gives you an independent check alongside it.
How often is the SBOM refreshed?
With every successful rebuild. Four rebuilds a year are included, and you start them when you choose: after a release, before an audit, or when we flag that the deposit has changed. If you release often, 12 rebuilds a year are available for $299 a month more.
How long do we have to keep it?
Article 13(13) asks manufacturers to keep the technical documentation and the EU declaration of conformity at the disposal of market surveillance authorities for at least 10 years after the product is placed on the market, or for the support period, whichever is longer. Each rebuild gives you a dated SBOM to file. See keeping the technical file.
When does this apply?
The CRA entered into force on 10 December 2024. Reporting obligations apply from 11 September 2026, and the main obligations from 11 December 2027.
We buy software. Can we ask suppliers for this?
Yes. Ask a critical supplier for Escrow Pro: you get release terms, and evidence from each rebuild, including the SBOM and a Recoverability Certificate, for your supplier file.
Is our code safe with you?
Codekeeper is ISO/IEC 27001:2022 certified. Deposits are encrypted at rest, and rebuilds run on our own models in the Codekeeper AI Verification Lab, so code stays in our environment. See the Trust Center.
An SBOM from a real rebuild. Ready when someone asks.
We'll take one of your products and show you a deposit, a rebuild and the SBOM it produces.