--- title: QCon London 2026: SBOMs Move From Best Practice to Legal... description: Viktor Petersson's QCon London 2026 talk covers the growing legal pressure on software teams to adopt SBOMs, driven by the EU Cyber Resilience Act (enforcement... canonical: https://daily.dev/posts/qcon-london-2026-sboms-move-from-best-practice-to-legal-obligation-as-cra-enforcement-looms-9cqs1mjyj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: QCon London 2026: SBOMs Move From Best Practice to Legal Obligation as CRA Enforcement Looms | daily.dev og:description: Viktor Petersson's QCon London 2026 talk covers the growing legal pressure on software teams to adopt SBOMs, driven by the EU Cyber Resilience Act (enforcement... og:url: https://daily.dev/posts/qcon-london-2026-sboms-move-from-best-practice-to-legal-obligation-as-cra-enforcement-looms-9cqs1mjyj og:image: https://api.daily.dev/og/posts/9CQS1mjYJ.png og:image:alt: QCon London 2026: SBOMs Move From Best Practice to Legal Obligation as CRA Enforcement Looms og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # QCon London 2026: SBOMs Move From Best Practice to Legal Obligation as CRA Enforcement Looms **[InfoQ](https://daily.dev/sources/infoq)** · 5 min read · 0 upvotes · 0 comments ## Summary Viktor Petersson's QCon London 2026 talk covers the growing legal pressure on software teams to adopt SBOMs, driven by the EU Cyber Resilience Act (enforcement starting September 2026), US Executive Order 14028, FDA requirements, and PCI-DSS 4.0. He explains the two dominant SBOM formats—SPDX and CycloneDX—and outlines a four-stage pipeline for high-quality SBOM generation: creation, augmentation, enrichment, and signing. Petersson warns against common mistakes like using generic scanners on large Docker images, skipping signing, and merging multi-ecosystem SBOMs. He also introduces the Transparency Exchange API (TEA), an OWASP/ECMA initiative for standardized SBOM distribution, and stresses that versioned SBOM lifecycle management is as critical as source code version control. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [How SBOMs and Engineering Discipline Can Help You Avoid Trivy’s Compromise](https://daily.dev/posts/how-sboms-and-engineering-discipline-can-help-you-avoid-trivy-s-compromise-c6zqbaibq) · InfoQ · 0 upvotes · 0 comments - [SBOM Generation for Container Workflows](https://daily.dev/posts/sbom-generation-for-container-workflows-nctydjhq9) · Docker · 4 upvotes · 0 comments - [SBOMs in 2026: Everyone's generating them, no one's using them](https://daily.dev/posts/sboms-in-2026-everyone-s-generating-them-no-one-s-using-them-6lbe79wsg) · Aikido Security · 0 upvotes · 0 comments - [Why are SBOMs failing to stop supply chain attacks?](https://daily.dev/posts/why-are-sboms-failing-to-stop-supply-chain-attacks--ggyykwmq1) · Sysdig Blog · 0 upvotes · 0 comments - [Software Bill of Materials \(SBOM\) Explained](https://daily.dev/posts/software-bill-of-materials-sbom-explained-x78srarkm) · Docker · 4 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#sbom](https://daily.dev/tags/sbom) [View this post on daily.dev](https://daily.dev/posts/qcon-london-2026-sboms-move-from-best-practice-to-legal-obligation-as-cra-enforcement-looms-9cqs1mjyj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"QCon London 2026: SBOMs Move From Best Practice to Legal Obligation as CRA Enforcement Looms","url":"https://daily.dev/posts/qcon-london-2026-sboms-move-from-best-practice-to-legal-obligation-as-cra-enforcement-looms-9cqs1mjyj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/qcon-london-2026-sboms-move-from-best-practice-to-legal-obligation-as-cra-enforcement-looms-9cqs1mjyj"},"datePublished":"2026-03-18T13:10:30.917Z","dateModified":"2026-03-18T13:15:11.953Z","description":"Viktor Petersson's QCon London 2026 talk covers the growing legal pressure on software teams to adopt SBOMs, driven by the EU Cyber Resilience Act (enforcement...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/16e41335349d47498c83194731b153ff?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/16e41335349d47498c83194731b153ff?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoQ","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoQ","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/afc3bced3e1e4b188dd9127017a60e0c","url":"https://daily.dev/sources/infoq"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/qcon-london-2026-sboms-move-from-best-practice-to-legal-obligation-as-cra-enforcement-looms-9cqs1mjyj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,sbom","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoQ","item":"https://daily.dev/sources/infoq"},{"@type":"ListItem","position":3,"name":"QCon London 2026: SBOMs Move From Best Practice to Legal Obligation as CRA Enforcement Looms"}]} ```