SBOMs in 2026: Everyone's generating them, no one's using them

What it is

A vendor analysis (Aikido Security) of ENISA's SBOM Adoption State of Play 2026 survey, ending in a product pitch. Beyond the headline stats in the summary, the page carries specific regulatory deadlines and format-version requirements an engineer planning CRA compliance can act on.

Preconditions / Affected

Organizations subject to the EU Cyber Resilience Act (CRA) — 80% of surveyed orgs are directly impacted. The CRA becomes fully applicable in December 2027; 79% expect to hit required maturity by then, meaning ~1 in 5 expect to miss it and 12% can't estimate a timeline.

What to do

Concrete compliance constraints the page names:

• Use a standard, machine-readable format. The CRA requires a "commonly used, machine-readable format." Germany's BSI guideline explicitly expects CycloneDX 1.6+ or SPDX 3.0.1+. The 28% still on proprietary/non-standard formats are a direct compliance risk.
• Maintain a first-level dependency inventory — the CRA requires an inventory of direct dependencies specifically. Note only 29% currently receive SBOMs covering all primary components + direct deps; 14% for full depth.
• Get SBOM clauses into supplier contracts. Only 10% have mandatory clauses today (55% working on it); 39% never receive supplier SBOMs. If you buy commercial software, this is the gap the CRA will pressure.
• Prioritize utilization over generation: wire SBOM data into vulnerability workflows, since most real-world vulns hide in transitive dependencies that thin SBOMs miss.

Caveats

The findings are self-reported survey data (334 orgs, 65% EU-based), so skewed toward CRA-affected European orgs. The back half of the piece is an Aikido product pitch (Syft-based generation, CycloneDX/SPDX export, vendor-SBOM import) — the "how Aikido helps" claims are marketing, not independent findings.