Windows 11 driver signing will require SBOMs and VEX statements starting March 2027

SBOMs and VEX statements required for all Windows 25H2/26H1 and Windows Server 2025 submissions starting 03/2027​

As part of our continued investment in the security and integrity of the Windows driver ecosystem, and in alignment with the EU Cyber Resilience Act (CRA), the Windows Hardware Compatibility Program (WHCP) policy for Windows 25H2/26H1 will introduce a new requirement for all driver submissions: a valid Software Bill of Materials (SBOM) and an accompanying Vulnerability Exploitability Exchange (VEX) statement. This post outlines what is changing, who is affected, and how to prepare.

What is changing

• Starting March 2027, for Windows 25H2/26H1 and Windows Server 2025 and later builds, the WHCP program requires every driver submission for WHCP signing to include a valid Software Package Data Exchange (SPDX) 3.0 formatted SBOM as part of the submission and a VEX statement clarifying if the driver submission is affected by a known open Common Vulnerability and Exposure (CVE). A submission will not receive a WHCP signature if the submission does not include both an SBOM and a VEX statement when applicable, or if the SBOM/VEX fails validation.
• Driver packages submitted before March 2027 will not be required to submit an SBOM or a VEX statement.
• Certification requirements for builds released prior to the Windows 25H2/26H1 and Windows Server 2025 builds will not include an SBOM or a VEX statement to be included with the submission.
• The above requirements apply to both HLK certified and attestation signed drivers.
• This change is being driven by CRA compliance obligations and is not negotiable. We recognize this is a meaningful shift, and we are committed to providing the tooling and guidance needed to help make this a smooth adoption process.

Who this affects

This affects all partners actively enrolled in the WHCP program who develop, sign, or submit drivers through HDC for a WHCP signature. If your company is planning a driver submission post March 2027 for the Windows 25H2/26H1 or the Windows Server 2025 OS, this requirement applies to you.

Tooling and timeline

Tools to generate compliant SBOMs, validate the SBOMs, and generate VEX statements will be made available as part of the Windows Driver Kit (WDK) by December 2026. Detailed documentation will be published alongside the WDK release. In addition, any open source/ industry standard SBOM generator tool can be utilized to generate the SBOM or VEX statement. However, the final artifact needs to adhere to the standard SPDX 3.0 format.

What you should do now

1. Familiarize your engineering and compliance teams with SBOM and VEX concepts (SPDX format).
2. Begin inventorying the third-party and open-source components used in your driver binaries.
3. Plan to adopt the WDK SBOM tooling when it ships in December 2026, ahead of the March 2027 submission windows. A current version of the tool which is available now can be used to familiarize your team with the tool and concepts. Please note that the current tool will be replaced with a new tool which will be available starting December 2026.

We will continue to share updates here as the policy, tooling, and submission experience are finalized. Thank you for partnering with us to raise the security bar for the Windows driver ecosystem.

SBOM Placement in Your Driver Submission Package

• Place your SBOM and VEX files in a subfolder within your driver package folder. There would be an option to add an SBOM/ VEX folder presented as a part of the experience to generate the HLKX
• Please ensure that there is one SBOM and VEX statement per driver in the driver package folder. If your submission contains N driver folders with M drivers each, you must provide N*M separate SBOMs and VEX statements.

Note: A driver in this case refers to a driver INF file and set of binaries corresponding to a single driver package

• DO NOT use a single SBOM/VEX statement to cover an entire submission that contains multiple driver folders.
• DO NOT place the SBOMs/VEX statements in the supplemental documents folder
• Note: This was the 2024 guidance and is not applicable to post March 2027
• SBOMs/VEX statements will not be distributed to end users as a part of a driver package.

SBOM Naming Conventions

• Name your SBOM file to match the INF name: <inf_name>.spdx.json
• Name the accompanying VEX file: <inf_name>.vex.json

Format and Technical Requirements

The technical requirements/ specifications for CRA compliant SBOMs are:

• SBOMs and VEX statements must be provided for all driver submissions both WHCP certified as well as attestation signed
• Any third-party SBOM generation tool is acceptable provided it outputs valid SPDX 3.0 format. The WDK ships its own tool at: Program Files\Windows Kits\10\Tools\10.0.26634.0\x64\sbom-tool-win-x64.exe
• Signed Software Bill of Materials must be provided in SPDX format for all firmware and software components.
• SBOMs must list all first-party and third-party components including tools, libraries, frameworks, and dependencies.
• All components must include accurate versions and package identifiers to enable vulnerability tracking.
• SBOMs and VEX statements must be COSE signed for integrity protection
• SBOMs must include all transitive dependencies, not just direct dependencies.
• SBOMs must be retained for the greater of 10 years or as required by EU GPSR and other applicable regulations for product lifecycle support.

In case of any questions, please reach out to Partner Center support and reference this requirement announcement. Further communications will be posted here as future blog posts.