Compliance
These nodes check SBOM content: whether the license data is right, and whether the SBOM contains what regulations require.
Verify Licenses
Verifies the license data in an SBOM against the FossID Knowledge Base.
Declared licenses are frequently wrong — omitted, guessed, or copied from a previous release. This node checks them against FossID's reference data and annotates what does not hold up.
| Category | Verification |
| Input | sbom |
| Output | sbom |
| Multiple inputs | Yes |
| Parameter | Type | Default | Description |
|---|---|---|---|
| KB Connection | connection — required | — | The FossID Knowledge Base connection to verify against. |
This node contacts the Knowledge Base, so it needs a working connection and will fail without one.
It can run directly after a reader — the built-in Can I trust this SBOM? template does exactly that. Adding Normalize Data in front improves results when your inputs are inconsistent, since canonicalized identifiers match Knowledge Base entries more reliably.
Regulatory Compliance
Checks whether an SBOM meets the requirements of the regulations you select. It adds error annotations for missing mandatory elements and warning annotations for missing recommended ones.
The node does not reject anything — it annotates. Pair it with Generate PDF Report to turn those annotations into a document, or with a Review step if someone should decide what to do about them.
| Category | Policy |
| Input | sbom |
| Output | sbom |
| Multiple inputs | Yes |
| Parameter | Type | Default | Description |
|---|---|---|---|
| EU Cyber Resilience Act (CRA) | boolean | true | Check against the EU Cyber Resilience Act (2024/2847): component identification, supply chain relationships, dependency relationships, and machine-readable format requirements. |
| US NTIA Minimum Elements | boolean | true | Check against the NTIA Minimum Elements for an SBOM (2021): supplier name, component name, version, unique identifiers, dependency relationship, SBOM author, and timestamp. |
| US CISA Minimum Elements (2025) | boolean | false | Check against the CISA 2025 SBOM Minimum Elements: all 11 required fields, including component hash, license, tool name, and generation context, on top of the NTIA baseline. |
What each regulation actually requires is summarized in Regulatory requirements.
Put this late in the pipeline. It reports on the SBOM as it exists at that point, so checking for completeness before the steps that fill gaps in reports problems your own workflow was about to fix.
Related
- Regulatory requirements.
- Generate PDF Report — turning annotations into a document.