NEWFree EU CRA product check · Nov 30Apply →
Z-BOMPhysical AI products

Firmware BOM solution

From hardware to AI models — meet regulatory requirements with BOMs

Build the bill of materials (BOM) that the EU CRA and FDA require, and keep tracking new vulnerabilities after release.

For · Physical AI manufacturers
Z-BOM · Component listsmart-cam_v3.1
364components · vulnerable 14
HBOM18SBOM342AIBOM4
SBOM3 CVEsopenssl1.1.1k
SBOM2 CVEsbusybox1.31.0
HBOM1 CVEWi-Fi modulefw 2.0.4
AIBOMVerified ✓person-detectonnx · v1.2
New CVE published · just now3 affected products foundProducts and versions containing openssl 1.1.1k
✓Export SPDX · CycloneDXDownload files for submission
WHY SBOM

SBOMs are no longer optional. They're a must.

Regulations now require SBOMs by default, and a string of CVE incidents has shown that without an SBOM you can't even begin to respond.

Regulation

SBOMs are becoming the regulatory baseline

  • EU CRAMakes SBOMs mandatory for products with digital elementsEU Cyber Resilience Act
  • US FDA 524BRequires an SBOM in premarket submissions for cyber devicesFD&C Act 524B
  • US Executive Order 14028Requires SBOMs for software sold to the federal governmentMay 2021
CVE incidents

Every incident starts with the same question

  • Log4ShellRemote code execution in Log4j, a Java logging libraryCVE-2021-44228 · Dec 2021
  • XZ Utils backdoorA backdoor hidden in a Linux compression libraryCVE-2024-3094 · Mar 2024
  • node2shellRemote code execution in the Node.js Brotli decoderCVE-2026-111497 · Oct 2026

"Is it in our products too?" With an SBOM, you can answer right away.

01 · Compliance

The BOMs regulations demand,
handled by Z-BOM

The EU CRA, FDA and MDR require a list of product components in a standard format and continued vulnerability management after release. Z-BOM meets both requirements.

01

SBOMSoftware

Extracts open-source and library components from source code, firmware and executables into SBOMs in global standard formats.
SPDXCycloneDXC·C++·PythonEXELinux·Android
02

HBOMHardware

Lists hardware components such as chips and modules, along with the firmware versions inside them.
Chips·modulesFirmware versions
03

AIBOMAI models

Tracks the source, version and composition of the AI models in your product.
LLM modelsSource·version
All threeEach list is linked to known vulnerabilities (CVEs), and you're alerted to new risks whenever a version changes.
02 · Incident response

But aren't you worried
about a breach?

What if customer video leaked from your camera? First, you have to find which products contain the faulty component.
With a BOM, you find it right away and act fast.

✕ Without an SBOM

Recheck every product

  • · Open each firmware image again, one by one
  • · Slow to see which versions are affected
✓ With Z-BOM

Identify in a single search

  • · Instantly find the products and versions with the faulty component
  • · Prioritize fixes, starting with affected products
03 · Deployment

Upload files directly,
or build it into your SDLC

Quick start

Upload directly

Upload firmware or source files to generate a BOM right away and link it to vulnerabilities.
SDLC integration

Add it to your build

Plug it into your CI/CD pipeline to regenerate the BOM and check for new vulnerabilities with every build.

Supported CI/CD · and growing

  • Jenkins
  • GitHub
  • GitLab
04 · Expert support

Stuck? Our experts will work with you

From building BOMs to regulatory submission, ZIEN experts who know your product category work alongside you.

CONTACT

Start with an SBOM of your product

Tell us the target product and format (source code or firmware), and we'll schedule a demo and reply within 5 business days.

support@zi-en.io · +82-70-4571-9854
FAQ

Frequently asked questions

QWhat can it analyze?View details ▾

It builds BOMs from source code, executables, firmware images and even AI models.

01Source code · C·C++·Python02Executables·firmware · EXE·Linux·Android03AI models · LLM models
QDoes it follow SBOM standards (SPDX, CycloneDX)?View details ▾

You can export in both standard formats: CycloneDX 1.2–1.6 (JSON, XML) and SPDX 2.2.2 and 2.3 (JSON, Tag-Value).

01SPDX02CycloneDX03Export
QCan we use it for supply chain requirements right away?View details ▾

We organize it so you can submit it in the format your customers and regulators require.

01Submission formats02CVEs by component03Change history