--- title: "SBOM Requirements by Jurisdiction (FDA, EU CRA, PMDA…)" description: "Where is an SBOM required for a medical device? Machine-readable SBOM rules across FDA §524B, EU CRA, MDCG 2019-16, Health Canada, PMDA, MFDS, MHRA, TGA, HSA and NMPA." lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "WebSite", "name": "The Medical Device Cybersecurity Crosswalk", "alternateName": "MDC Crosswalk", "url": "https://mdccrosswalk.com/", "description": "Compare FDA, EU MDR, MHRA, PMDA, NMPA, TGA, MFDS and Health Canada medical device cybersecurity requirements across 29 jurisdictions." }, { "@context": "https://schema.org", "@type": "Organization", "name": "MDC Crosswalk", "url": "https://mdccrosswalk.com/", "logo": "https://mdccrosswalk.com/favicon.png", "sameAs": [ "https://bluegoatcyber.com" ], "description": "An editorial reference comparing global medical-device cybersecurity regulations. Maintained by Blue Goat Cyber." }, { "@context": "https://schema.org", "@type": "Article", "headline": "SBOM Requirements for Medical Devices, by Jurisdiction", "description": "Comprehensive guide to where a software bill of materials (SBOM) is required, recommended or emerging for medical devices worldwide.", "author": { "@type": "Organization", "name": "MDC Crosswalk" }, "publisher": { "@type": "Organization", "name": "MDC Crosswalk" }, "mainEntityOfPage": "https://mdccrosswalk.lovable.app/topics/sbom-by-jurisdiction" }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What format should my SBOM be in?", "acceptedAnswer": { "@type": "Answer", "text": "CycloneDX or SPDX, both in machine-readable form (JSON or XML). The FDA explicitly names both; the EU CRA, PMDA, Health Canada and MFDS accept either. CycloneDX has slightly broader medical-device tooling support; SPDX is the older ISO/IEC 5962:2021 reference." } }, { "@type": "Question", "name": "Do I need a separate SBOM per market?", "acceptedAnswer": { "@type": "Answer", "text": "No. Generate one SBOM per release in CycloneDX or SPDX, then distribute the same file to every regulator. The deltas are in the surrounding documentation (vulnerability summary, support level, update timeline), not in the SBOM itself." } }, { "@type": "Question", "name": "How often must I regenerate the SBOM?", "acceptedAnswer": { "@type": "Answer", "text": "At every release of the device software, plus whenever a third-party component (library, container image, firmware blob) changes. Most teams automate this in CI so the SBOM ships alongside the build artifact." } }, { "@type": "Question", "name": "Does the SBOM need to include known vulnerabilities?", "acceptedAnswer": { "@type": "Answer", "text": "FDA §524B requires a known-vulnerability summary AND the support level for each component. This is typically expressed as a separate VEX document (Vulnerability Exploitability eXchange) referencing the SBOM by hash." } } ] }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://mdccrosswalk.lovable.app/" }, { "@type": "ListItem", "position": 2, "name": "Topics" }, { "@type": "ListItem", "position": 3, "name": "SBOM by jurisdiction" } ] } ] --- [ The Crosswalk ](/) [Overview](/)[Playbook](/playbook)CompareReference [New Per-page social previews and this changelog ](/changelog "Per-page social previews and this changelog") Search⌘K 1. [Home ](/) 2. Topics 3. SBOM by jurisdiction SBOM # Software Bill of Materials, by jurisdiction. Where a machine-readable SBOM is mandatory, expected or still emerging - and which format satisfies the most regulators with the least rework. Last updated · July 25, 2026 TL;DR Generate one CycloneDX (or SPDX) SBOM per release. It satisfies FDA today, PMDA today, Health Canada today, and the EU CRA from December 2027 - no per-market rework. Pair it with a VEX file describing known vulnerabilities and per-component support level. ## Per-jurisdiction status [ ![Flag of United States](/flags/us.svg) United States FDA / CDRH Required Machine-readable; SPDX or CycloneDX. §524B(b)(3) since March 2023. ](/standards/fda)[ ![Flag of European Union](/flags/eu.svg) European Union EC / MDCG Required (CRA) Expected today by Notified Bodies under MDCG 2019-16; statutory under CRA from 11 Dec 2027. ](/standards/eu)[ ![Flag of Canada](/flags/ca.svg) Canada Health Canada Expected Health Canada 2024 pre-market guidance expects SBOM for Class III/IV. ](/standards/ca)[ ![Flag of Japan](/flags/jp.svg) Japan PMDA / MHLW Required PMDA 2024 cybersecurity notification mandates SBOM for connected devices. ](/standards/jp)[ ![Flag of South Korea](/flags/kr.svg) South Korea MFDS Expected MFDS guidance references IMDRF N73; SBOM strongly encouraged. ](/standards/kr)[ ![Flag of United Kingdom](/flags/gb.svg) United Kingdom MHRA Expected MHRA aligns with MDCG 2019-16; SBOM expected, becomes explicit in UK SaMD framework. ](/standards/uk)[ ![Flag of Australia](/flags/au.svg) Australia TGA Expected TGA aligns to IMDRF N73; SBOM expected for connected devices. ](/standards/au)[ ![Flag of Singapore](/flags/sg.svg) Singapore HSA Expected HSA's Regulatory Guidelines for Software Medical Devices reference IMDRF N73. ](/standards/sg)[ ![Flag of China](/flags/cn.svg) China NMPA Emerging NMPA references in cybersecurity guidance; format not yet standardised. PIPL/DSL overlays. ](/standards/cn)[ ![Flag of Brazil](/flags/br.svg) Brazil ANVISA Emerging ANVISA RDC 657/2022 cyber annex; SBOM expectation tracking IMDRF N73. ](/standards/br) ### CycloneDX vs SPDX Both are accepted everywhere SBOM is required. CycloneDX (OWASP) has richer vulnerability integration via VEX and broader medical-device tooling. SPDX (Linux Foundation, ISO/IEC 5962:2021) has stronger licensing metadata and longer regulatory history. If you have no preference, default to CycloneDX 1.5 JSON. ### SBOM is not enough An SBOM lists components. Regulators want to know which components are exploitable in your device. Ship a VEX file (CycloneDX VEX or CSAF 2.0) alongside the SBOM, declaring exploitability status for each known CVE. FDA reviewers explicitly look for this in §524B submissions. ## Frequently asked ### What format should my SBOM be in? CycloneDX or SPDX, both in machine-readable form (JSON or XML). The FDA explicitly names both; the EU CRA, PMDA, Health Canada and MFDS accept either. CycloneDX has slightly broader medical-device tooling support; SPDX is the older ISO/IEC 5962:2021 reference. ### Do I need a separate SBOM per market? No. Generate one SBOM per release in CycloneDX or SPDX, then distribute the same file to every regulator. The deltas are in the surrounding documentation (vulnerability summary, support level, update timeline), not in the SBOM itself. ### How often must I regenerate the SBOM? At every release of the device software, plus whenever a third-party component (library, container image, firmware blob) changes. Most teams automate this in CI so the SBOM ships alongside the build artifact. ### Does the SBOM need to include known vulnerabilities? FDA §524B requires a known-vulnerability summary AND the support level for each component. This is typically expressed as a separate VEX document (Vulnerability Exploitability eXchange) referencing the SBOM by hash. Sponsored note · Blue Goat Cyber Stuck generating a regulator-ready SBOM? Blue Goat Cyber generates CycloneDX SBOMs + VEX files for FDA, EU and PMDA submissions and integrates them into your CI pipeline. [Talk through your SBOM](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) The Crosswalk An independent reference for global medical device cybersecurity standards. A field guide for MedTech innovators and RA/QA teams charting an international path. Resource - [Comparison matrix](/compare) - [Global playbook](/playbook) - [Glossary](/glossary) - [FAQ](/faq) Sponsored by [Blue Goat Cyber ↗](https://bluegoatcyber.com) Editorially independent. Sponsorship keeps it free. © 2026 The Crosswalk. Not legal advice. Validate every requirement against current regulator publications.