FDA-JUST-001 warning

If SBOM information is missing, a justification is present

Pack fda-524b 1.0.0

Severity: warning
The guidance provides an explicit escape hatch, and it is one almost nobody uses. A submission with gaps and no justification looks like an oversight. The same submission with a written justification looks like a decision, and reviewers treat the two differently.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$.metadata","spdx":"$"}
On an empty selector: fire
The selector names a specific object the assertion inspects. When that object is absent the information the rule exists to check was not supplied at all, which is a stronger failure than supplying it badly. Reporting nothing would make a missing section indistinguishable from a satisfied one.
Fix: Where SBOM information cannot be provided, include a written justification for why it cannot be included in the premarket submission.
Source: fda-premarket-2026-02: Section V.A.4(b): 'If a manufacturer is unable to provide the SBOM information to FDA, the manufacturer should provide a justification'
Note: Underused and cheap. Pair this with the CISA practice on explicitly identifying unknown information.

Check a file against this

npx stratifypro check sbom.json --pack fda-524b
npx stratifypro explain FDA-JUST-001 --pack fda-524b prints this page.