Make Your SBOM FDA-Ready in Minutes — Not Months

SBOMCheck automatically enriches every component in your SPDX or CycloneDX SBOM with maintenance status and end-of-support dates — exactly what FDA's cybersecurity guidance requires.

Analyze Your SBOM Free See a Live Demo

No credit card required · SPDX & CycloneDX supported · Results in under 60 seconds

sbomcheck.online/dashboard/results/...

Component	Version	Status	EOS Date
lodash	4.17.21	Actively Maintained	No Fixed EOL
log4j-core	2.14.1	No Longer Maintained	Dec 31, 2021
openssl	1.1.1	Abandoned	Sep 11, 2023
requests	2.28.0	Actively Maintained	No Fixed EOL

Trusted by medical device and health tech teams

MedTech Co.HealthAI Inc.DeviceFlowRegReadySecureMedComplyLabs

(logos shown with permission)

“We went from manually researching 200+ SBOM components to having a complete, FDA-ready lifecycle report in under two minutes.”

— Head of Regulatory Affairs, Medical Device Startup

FDA Now Requires This. Most SBOMs Don't Have It.

Under FDA's 2023 cybersecurity guidance and the PATCH Act, every SBOM submitted with a 510(k) or PMA must include:

• Maintenance status of each software component
• End-of-support date for each component

For open-source dependencies, this information is scattered across GitHub, npm, PyPI, endoflife.date, and security databases. Gathering it manually for even a mid-size product can take days.

1Export SBOM

2Research each component manually

3Weeks of spreadsheet work

4FDA submission delayed

From Upload to FDA-Ready in 3 Steps

Drop Your SBOM

Upload any SPDX or CycloneDX file — JSON, XML, YAML, TV, or RDF. We parse all versions automatically.

We Do the Research

SBOMCheck queries endoflife.date, npm, PyPI, Maven, GitHub, and OpenSSF Scorecard for every component. AI fills in the gaps.

Download FDA-Ready Output

Get an enriched SBOM file plus a formatted PDF report with methodology disclosure — ready to attach to your submission.

Average enrichment time: ~45 seconds for 100 components

Multi-Source Enrichment Engine

We use a 5-layer strategy: endoflife.date first, then package registries (npm, PyPI, Maven, etc.), then GitHub/GitLab, then OpenSSF Scorecard, and finally an AI fallback for ambiguous components. Each result is tagged with its confidence level so you know the source.

endoflife.date ✓GitHub ✓High Confidence

Component detail panel with source badges

Confidence Scoring

Every result shows whether it came from an authoritative source or was AI-inferred. Your QA team knows exactly what to review before submission.

High

Medium

AI-Inferred ◐

PDF Report for FDA Submission

Exports a professionally formatted PDF with a cover page and methodology section explaining data sources and heuristics — exactly the kind of disclosure FDA reviewers expect.

SBOM Lifecycle Enrichment Report

Methodology: Data sources include endoflife.date, package registries, GitHub, OpenSSF Scorecard, and optional AI fallback. Results tagged by confidence.