Reporting timelines vs SBOM

[NorioKobota]

[File URL / Relevant Section Number]
https://github.com/OpenChain-Project/SBOM-wg/blob/main/Cross-Industry-SBOM-Quality-Guide/en/chapters/03-guidelines-to-enhance-sbom-document-quality.md

[Subject Text]
Need to add in Chapter 3?

[Comments / Suggested Changes]
The CRA's vulnerability reporting timelines (24h, 72h, 14 days, one month) should be connected to SBOM quality requirements, as the SBOM is the instrument that enables compliance with those timelines.

[Comments from]
Ibrahim Haddad

[Dates]
2026-04-07

[NorioKobota]

While high-quality SBOMs can support compliance with CRA reporting timelines, those timelines are process requirements rather than SBOM document quality requirements. For this reason, they are currently outside the scope of this guide, although we may consider adding explanatory guidance in a future revision.