Your SBOM needs checking after you ship it, not just once
The CISA KEV catalog flags dependencies you shipped that are now under active exploitation, the trigger Article 14 cares about.
Picture a solo developer who ships a paid WordPress plugin. Before his last release, he generated a software bill of materials listing his direct dependencies. One file, one date, done.
Three weeks later, one of those dependencies gets a CVE. A few days after that, CISA adds it to the Known Exploited Vulnerabilities catalog, a public list of flaws with confirmed active exploitation in the wild.
His SBOM stays silent about this. It was accurate the day he wrote it, a snapshot fixed at that date.
What the SBOM actually covers
Annex I, part II, point 1 of the Cyber Resilience Act requires an SBOM covering at least first-level dependencies. It's a static list. Someone still has to check it against new vulnerabilities as they surface, on their own or with a tool.
Why the KEV catalog matters here
CISA's KEV catalog lists vulnerabilities with confirmed active exploitation. That lines up with Article 3, point 42, which defines "actively exploited" as reliable evidence that a malicious actor has exploited a vulnerability on a system without the owner's authorization.
If one of the developer's dependencies lands on that list, he gets a date: the day the exploitation was confirmed. That date matters. Under Article 14, the 24-hour early warning and the 72-hour notification both run from the moment he becomes aware, not from when a CSIRT finds out some other way.
What checking looks like in practice
Checking his lockfile against the KEV catalog on a schedule, weekly works for most small teams, gives him that date directly. Waiting for a support ticket or a security researcher's email means he learns the same fact later, with his 24 hours already partly gone.
The rest of the SBOM requirements, the format, the depth, the documentation, apply from 11 December 2027 under Article 71. Article 14 doesn't wait for that date. It has been running since 11 September 2026.
Before any of that
One question decides whether Article 14 applies to him at all: whether he counts as a manufacturer under Article 3, point 13. The scope test walks through it in two minutes: https://crakit.eu/scope/
Not legal advice.
This is not legal advice.