EU CRA for AI-Enabled Products: Documenting AI Components with an AI BOM
If your product includes machine-learning models, the Cyber Resilience Act still applies. An AI BOM extends your component inventory to the models, datasets and AI libraries the CRA expects you to manage.
- The CRA covers products with digital elements, and AI-enabled software is not exempt; it can also fall under the EU AI Act in parallel.
- An AI BOM documents models, datasets, frameworks and AI libraries as first-class components alongside the SBOM.
- AI components carry their own supply-chain risks: poisoned data, tampered weights, vulnerable ML dependencies.
- An AI BOM feeds the same CRA vulnerability-handling and update duties that apply to any other component.
AI products are in scope of the CRA
The Cyber Resilience Act, Regulation (EU) 2024/2847, applies to products with digital elements, and software that embeds machine learning is squarely included [1]. A product can be subject to both the CRA and the EU AI Act, Regulation (EU) 2024/1689 [2]; the AI Act governs the AI system's risk and documentation, while the CRA governs its cybersecurity as a product. The two are designed to work together, and an AI BOM serves both.
What an AI BOM adds
An SBOM lists the conventional software in a product. An AI BOM extends that inventory to the parts that make a system intelligent: trained models and their versions and hashes, training and evaluation datasets, ML frameworks and their dependencies, and the pipelines that produce them. Under the CRA's component-documentation and vulnerability-handling duties, these cannot be a blind spot.
AI-specific supply-chain risks the CRA cares about
- Data poisoning. Tainted training data that degrades or backdoors a model.
- Model tampering. Weights altered in transit or at rest; integrity is a CRA concern.
- Vulnerable ML dependencies. Deserialisation and other CVEs in common ML libraries.
- Opaque provenance. Models pulled from public hubs with no record of origin.
| AI BOM element | CRA relevance |
|---|---|
| Model inventory with hashes | Integrity and affected-version reporting |
| Dataset lineage | Provenance and tamper evidence |
| ML framework dependencies | Vulnerability handling, same as any SBOM component |
How IntelliXBOM helps
IntelliXBOM generates AI BOMs covering models, datasets, pipelines and AI libraries, records versions and hashes, and correlates AI dependencies with known vulnerabilities, alongside the product's SBOM, CBOM and HBOM in one inventory. See AI supply-chain risks and the EU AI Act and the AI BOM. The platform provides evidence; conformity remains the manufacturer's responsibility.
Frequently asked questions
Can a product be covered by both the CRA and the EU AI Act?
Yes. The CRA covers the product's cybersecurity, while the AI Act governs the AI system's risk classification and documentation. They are intended to be complementary, and an AI BOM supplies evidence for both.
Does the CRA require an AI BOM specifically?
The CRA requires documenting components and handling their vulnerabilities. For AI-enabled products that logically extends to models, datasets and AI libraries, which an AI BOM captures in a structured, machine-readable way.
How do I document a model pulled from a public hub?
Record its source, version and a hash in the AI BOM so you can detect tampering and report affected versions. Prefer models with clear provenance and a verifiable integrity check.
Sources
- Regulation (EU) 2024/2847 (Cyber Resilience Act)EUR-Lexeur-lex.europa.eu/eli/reg/2024/2847/oj
- Regulation (EU) 2024/1689 (Artificial Intelligence Act)EUR-Lexeur-lex.europa.eu/eli/reg/2024/1689/oj
- CycloneDX Bill of Materials standardOWASP CycloneDXcyclonedx.org/
- EU Agency for Cybersecurity (ENISA)ENISAwww.enisa.europa.eu/
Sources checked in September 2026. Regulations and guidance change; always refer to the issuing body’s current publication. This content is for general information and is not legal advice.