In response to the requirements of the European Cyber Resilience Act (CRA), ENISA launched a survey at the end of 2025 to collect factual data on how organisations across sectors and of different sizes approach the adoption of a Software Bill of Materials (SBOM). The resulting document analyses the survey findings, which confirm that the CRA is acting as a significant accelerator for SBOM adoption. Organisations are investing heavily in SBOM generation and automation in order to integrate SBOMs into the Software Development Life Cycle (SDLC), while also bringing implementation schedules forward to achieve the expected level of maturity and regulatory compliance.
The document is available here: SBOM Adoption: State of Play 2026