The german BSI published a Technical guidelines document on how to create SBOMs to be compliant with the CRA draft.

https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TR03183/BSI-TR-03183-2-2_0_0.pdf?__blob=publicationFile&v=3

https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Standards-und-Zertifizierung/Technische-Richtlinien/TR-nach-Thema-sortiert/tr03183/TR-03183_node.html

Going through the document, this is a list of informal notes were we might not be compliant or have not been addressed yet:

• component name should be the file name (is this super strictly required?), 
• pure file names without paths not included
• no sha512 checksum
• whether a file is "structured"
• potential 'LicenseRef-scancode-' refs to qt licenses,
  found scancode qt licenses
  https://scancode-licensedb.aboutcode.org/?search=qt
• the whole concluded open source vs commercial license thing
• potentially reproducible builds
• potentially including info about code generators like qlalr, syncqt, python execution used to generate qml regex jit tables