The actual requirement Annex I Part II (1), Art. 13(8)
The SBOM duty lives in the vulnerability handling requirements of Annex I, Part II. Point (1) requires manufacturers to identify and document the vulnerabilities and components contained in their products, "including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the products". These requirements are made binding on manufacturers through Article 13(8).
Two things are worth reading precisely. The format must be commonly used and machine-readable. And the coverage floor is the top-level dependencies "at the very least", which means deeper is allowed and often sensible, but the minimum obligation is the top level.
Where the SBOM lives: technical documentation Annex VII (2)(b), Art. 31, Art. 13(24)
The SBOM is not a standalone deliverable floating on its own. Annex VII, which lists the content of the technical documentation, requires the specifications of the vulnerability handling processes to include the software bill of materials, alongside the coordinated vulnerability disclosure policy and the secure-update approach. So the SBOM is one element of the evidence file behind your conformity.
The Commission may, by implementing act, specify the format and elements of the SBOM referred to in Annex I, Part II, point (1). Until and unless it does, the operative standard is simply "commonly used and machine-readable", which is where the common tooling formats come in as practice.
No general duty to publish it Annex II (9), Annex VII (8), Art. 13(25)
This is the point most often overstated. The CRA does not impose a general obligation to publish your SBOM to the world. In the information and instructions to the user (Annex II), the SBOM appears only conditionally: if the manufacturer decides to make the SBOM available to the user, then the user information must say where it can be accessed. The trigger is your own decision to make it available.
Separately, market surveillance authorities can require the SBOM on a reasoned request where it is necessary to check compliance, and ADCO may request SBOMs for a Union-wide dependency assessment. Those are targeted disclosures to authorities, not publication to the public.
Format in practice: CycloneDX and SPDX Annex I Part II (1), Art. 13(24)
Because the regulation says "commonly used and machine-readable" rather than naming a standard, the practical answer is to use one of the formats the industry already treats as standard. CycloneDX and SPDX are the two widely adopted machine-readable SBOM formats, and tooling such as syft can generate them in a CI pipeline. Treat this as good practice that satisfies the wording, not as a legal requirement to use either one specifically.