The European Union Agency for CyberSecurity (ENISA) released its Guidelines for Securing the IoT – Secure Supply Chain for IoT in November 2020. SBOMs are part of the guidelines for both the processes PRO-05 “Identifying Third-Party Software” and PRO-13 “Provide Software Bill Of Materials (SBOMs) for IoT Devices”

ENISA publication: https://www.enisa.europa.eu/news/enisa-news/iot-security-enisa-publishes-guidelines-on-securing-the-iot-supply-chain

Document page: https://www.enisa.europa.eu/publications/guidelines-for-securing-the-internet-of-things