In short

Your pubspec.lock already lists every Dart and Flutter package in the app, with exact versions.

Turn it into a CycloneDX SBOM, then add the native side: ios/Podfile.lock and the Android Gradle dependencies.

Generate a new SBOM for every release and keep it with the app's technical documentation.

Why a Flutter app needs an SBOM now

The EU Cyber Resilience Act (Regulation (EU) 2024/2847) applies to software placed on the EU market as part of a commercial activity. That includes most mobile apps published by companies, even free ones.

Annex I, Part II asks manufacturers to identify and document the components of their product, including by drawing up a software bill of materials (SBOM) in a commonly used, machine-readable format, covering at least the top-level dependencies. The full requirements apply from 11 December 2027.…