EU CRA and Hardware: Using an HBOM for Products with Digital Elements
The Cyber Resilience Act is not only about software. Connected hardware is a product with digital elements, and an HBOM is how you document the devices, firmware and components it expects you to manage.
- The CRA explicitly covers hardware products with digital elements, not just standalone software.
- An HBOM inventories the physical components, firmware and manufacturers in a device.
- Firmware and hardware carry CVEs too; the CRA's vulnerability-handling duties apply to them.
- An HBOM plus firmware SBOMs give you the component visibility CRA conformity assessment needs.
Hardware is a product with digital elements
The Cyber Resilience Act, Regulation (EU) 2024/2847, applies to products with digital elements, a definition that covers connected hardware as well as software [1]. A router, a sensor, an industrial controller or a medical device placed on the EU market must meet the essential requirements and handle vulnerabilities across its support period, just like a software product. That means knowing what is inside the hardware.
What an HBOM documents
A hardware bill of materials (HBOM) inventories the physical and firmware components of a device: processors, memory, storage, network interfaces, firmware and BIOS, and the manufacturers behind them [2]. Paired with firmware SBOMs, it gives the full picture the CRA's component-identification and vulnerability-handling duties require.
Firmware and hardware vulnerabilities count
Vulnerabilities are not only in application code. Firmware images, bootloaders and hardware components have their own CVEs, and a CRA manufacturer must be able to identify affected products and ship updates. An HBOM, with firmware analysed into SBOMs, lets you answer which devices are affected when a firmware or component vulnerability is disclosed:
| HBOM element | CRA relevance |
|---|---|
| Component and manufacturer inventory | Component identification under Annex I |
| Firmware versions | Affected-version reporting and security updates |
| Supplier trace | Supply-chain due diligence and recalls |
How IntelliXBOM helps
IntelliXBOM generates HBOMs during scanning, analyses firmware into SBOMs, maps components to manufacturers, and correlates firmware and hardware components with known vulnerabilities, in the same inventory as the product's software and cryptography. See firmware BOMs and hardware supply-chain risks. The platform provides evidence; CRA conformity remains the manufacturer's responsibility.
Frequently asked questions
Does the CRA really cover hardware?
Yes. The CRA applies to products with digital elements, which includes connected hardware and its firmware, not only standalone software applications.
Do I need an SBOM or an HBOM for a connected device?
Usually both. An HBOM documents the physical components and firmware, while SBOMs, including firmware analysed into an SBOM, document the software. Together they meet the CRA's component-documentation duties.
How do I handle a firmware vulnerability under the CRA?
Identify affected devices from your HBOM and firmware inventory, provide a security update within your support commitments, and, where it is actively exploited, meet the CRA reporting timelines that apply from 11 September 2026.
Sources
- Regulation (EU) 2024/2847 (Cyber Resilience Act)EUR-Lexeur-lex.europa.eu/eli/reg/2024/2847/oj
- CycloneDX Bill of Materials standardOWASP CycloneDXcyclonedx.org/
- EU Agency for Cybersecurity (ENISA)ENISAwww.enisa.europa.eu/
Sources checked in September 2026. Regulations and guidance change; always refer to the issuing body’s current publication. This content is for general information and is not legal advice.