- 7th September 2026
CRA and DORA both treat the SBOM as evidence a regulator can demand on any given day. Most manufacturers have a file generated per build instead of a record they can query. Here’s the identifier gap that breaks it, and the screens Phoenix built to close it.
Francesco Cipollone