OCImendby CloudTrace

EU Cyber Resilience Act for container images: SBOM, VEX and 24-hour reporting

OCImend · 2026-09-26

Short answer

Under the EU Cyber Resilience Act, manufacturers must report actively exploited vulnerabilities within 24 hours from 11 September 2026, and keep a machine-readable SBOM for products by December 2027. For images: generate an SPDX or CycloneDX SBOM per release, watch for KEV-listed CVEs, and use VEX to state which findings do not affect you.

DateObligationContainer practice
11 Sep 2026report actively exploited vulnerabilities (24 h)alerts on new KEV CVEs in images you ship
11 Dec 2027SBOM and vulnerability handling for productsSPDX 2.3 / CycloneDX 1.6 per image digest
  1. 01SBOMper digest
  2. 02WatchKEV, daily
  3. 03Alertwithin hours
  4. 04VEXnot affected, with reason

Export an SBOM →

Questions

Which SBOM format should I use?
Either SPDX 2.3 or CycloneDX 1.6; both are machine-readable and accepted. OCImend exports both.

Sources

More guides