Your SBOM isn’t for the compliance team
Most developers I talk to see the SBOM as a file the compliance team wants from them. The CRA’s 24-hour reporting clock shows what it really is: the fastest answer to the first question in any vulnerability case — which of the versions we shipped contain this component?