FDA requirements for SBOM submission: summary, machine-readable formats, and PDF attachments

Question

Our company recently submitted a 510(k) and received questions from the FDA about our Software Bill of Materials (SBOM). Specifically, the FDA is asking for a "summary" of the SBOM and requests the SBOM in PDF format.
I understand that SBOMs must be provided in machine-readable, industry standard formats (such as SPDX). However, I could not find any mention of an SBOM "summary" in FDA guidance documents. 
Has anyone submitted SBOMs as PDF to the FDA? What does an SBOM summary typically look like? Are auditors expecting all required information in a list or spreadsheet format?

Dr. Oliver Eidel · Accepted Answer

Yes, submitting SBOMs as PDF is common practice for FDA submissions, even though the guidance mentions machine-readable formats like SPDX or JSON. In practice, many auditors expect a human-readable summary (such as a table or spreadsheet) in PDF format alongside the machine-readable file. A typical SBOM summary includes columns like Component Name, Version, Unique Identifiers, Dependency Relationships, Known Vulnerabilities, and sometimes additional fields like support level or end-of-support date. 
It's also helpful to add a brief introduction explaining your SBOM process, how you manage vulnerabilities, and how the summary ties into your broader submission. This makes it easier for the reviewer to understand and reduces the chance of additional questions.

Answer

eSTAR does technically accept a variety of attachment formats, including Excel and mp4 files, not just PDFs. However, in practice, auditors may prefer PDFs, and some may not be familiar with opening other file types like JSON. It's usually safest to provide key documents as PDFs to avoid confusion or delays.

FDA requirements for SBOM submission: summary, machine-readable formats, and PDF attachments

2 Answers

Keep reading

Is it necessary to include device classification and intended use in every section of DHF and TD documentation?

Design History File (DHF) for SaMD: Your Software's Design Story

Post-Market Clinical Follow-Up Plan (PMCFP)