Last updated: 2026-10-09
The Cyber Resilience Act (Regulation (EU) 2024/2847) requires manufacturers to make their products with digital elements secure, and it requires evidence of that security. Two document packages provide this evidence: the technical documentation under Annex VII and the EU Declaration of Conformity under Article 28 in conjunction with Annex V. Both are prerequisites for CE marking (Art. 30) and therefore for lawfully placing a product on the EU market. This article explains, in general and practice-oriented terms, what to prepare and keep - it is not legal advice.
From when? The core manufacturer duties - including the Annex I requirements, conformity assessment and CE marking - apply from 11 December 2027 (general application, Art. 71(2)). The Art. 14 reporting obligations have already applied since 11 September 2026. Entry into force on 10 December 2024 is not a compliance date. Setting up the documentation early avoids rework.
Why these documents are the backbone of CRA compliance
The technical documentation is the internal evidence that a product meets the essential cybersecurity requirements set out in Annex I. The EU Declaration of Conformity is the externally visible, legally binding assurance by the manufacturer that this is indeed the case. Market surveillance authorities may request the technical documentation on a reasoned request; it is the basis of any inspection. For infringements of the manufacturer obligations in Art. 13, which include drawing up the technical documentation, Art. 64(2) provides for fines of up to EUR 15 million or 2.5% of worldwide annual turnover, and Art. 64(3) up to EUR 10 million or 2% for infringements of the technical documentation provisions in Art. 31(1) to (4). Incorrect, incomplete or misleading information supplied in response to a request from authorities or notified bodies can attract fines of up to EUR 5 million or 1% (Art. 64(4)), whichever is higher in each case.
Both packages belong together and build on each other: without complete technical documentation, the statement of conformity in the EU Declaration of Conformity lacks a basis, and without the declaration the CE marking may not be affixed. The documentation is updated over the whole product life cycle, for example when new versions are released, the architecture changes or vulnerabilities are fixed.
What the technical documentation must contain (Annex VII)
Annex VII sets out the substantive components, insofar as they are relevant to the product concerned. The documentation must be comprehensive enough to demonstrate conformity with the requirements; its scope and depth depend on the nature and risk of the product. Core components:
| Component (Annex VII) | What it concretely includes |
|---|---|
| Product description | General description incl. intended purpose, security-relevant software versions, photographs or illustrations for hardware, user information and instructions under Annex II |
| Design, development, production | System architecture, how software components interact, security functions applied, production and monitoring processes |
| Vulnerability-handling processes | SBOM, CVD policy (coordinated disclosure), evidence of the contact address for reports, secure update-distribution path |
| Cybersecurity risk assessment | The assessment with reference to the requirements of Annex I, including how far Annex I Part I applies |
| Support period | Information taken into account when determining the support period (at least five years, shorter only where the expected time of use is shorter) |
| Standards/specifications applied | Harmonised standards, common specifications or European certification schemes applied in full or in part - otherwise a description of the solutions adopted |
| Test and inspection reports | Reports on the tests and examinations performed against Annex I Parts I and II |
| Copy of the EU Declaration of Conformity | The complete EU Declaration of Conformity as part of the documentation |
The SBOM - with no mandated format
The software bill of materials is anchored in Annex I Part II: in a commonly used, machine-readable format covering at least the top-level dependencies. Importantly, the Regulation mandates no specific format. Examples of machine-readable formats are CycloneDX and SPDX (ISO/IEC 5962); what counts for the requirement is the content, at least the top-level dependencies. Art. 13(24) empowers the Commission to specify format and elements by implementing act; no such act had been adopted when we checked on 9 October 2026. The SBOM is provided to the market surveillance authority on reasoned request (Annex VII point 8) - it is not necessarily public. For more depth, see our article on the SBOM requirements under the CRA.
The CVD policy and the update-distribution path
The technical documentation must show that you have put in place a coordinated vulnerability disclosure (CVD) policy; it is mandatory under the CRA (Annex I Part II point 5). It includes a contact address for reports, the process to address and remediate vulnerabilities without delay, and a secure distribution path for security updates, which must be disseminated without delay and free of charge (a different arrangement is possible for tailor-made products for business users). These processes run throughout the entire support period. Describe them as they are actually practised, with responsibilities and response times. Ideally the documentation refers to the internal policies, tickets or process descriptions that evidence each step.
The EU Declaration of Conformity (Art. 28, Annex V)
With the EU Declaration of Conformity, the manufacturer assumes sole responsibility that the product meets the applicable requirements. The minimum content follows from Annex V:
- Name and type and any additional information enabling the unique identification of the product
- Name and address of the manufacturer or its authorised representative
- Statement that the declaration is issued under sole responsibility
- Object of the declaration (identification of the product allowing traceability, with a photograph where appropriate)
- Statement of conformity: the product is in conformity with the relevant Union harmonisation legislation
- References to the relevant harmonised standards, common specifications or cybersecurity certification used
- Where applicable, the notified body: name, number, procedure performed, identification of the certificate issued
- Place and date of issue, name, function and signature
Whether a notified body must be involved depends on the product class. Products not listed in Annex III or IV may self-assess (Module A). For Class I, Module A is sufficient only if harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least ‘substantial’ are applied in full; otherwise a notified body must be involved (Modules B and C, or H). For Class II and critical products, third-party assessment is required. Our applicability check gives a first orientation.
CE marking (Art. 30)
Only once the technical documentation, risk assessment, conformity assessment and EU Declaration of Conformity are in place may the CE marking be affixed. It is the visible signal that the manufacturer declares conformity with the CRA (and, where relevant, further applicable EU legislation). CE marking is a prerequisite for placing on the market - without the underlying documentation, it is not permitted.
Retention: at least 10 years
Manufacturers must retain the technical documentation and the EU Declaration of Conformity for at least 10 years after the product has been placed on the market - or for the duration of the support period, whichever is longer. Both documents must be kept available for market surveillance authorities.
Practical checklist: preparing the technical documentation
- Product description incl. intended purpose, security-relevant software versions and user information under Annex II created
- Architecture and data-flow documentation in place
- SBOM in a commonly used, machine-readable format (at least top-level dependencies) maintained and versioned
- CVD policy documented, contact address for vulnerability reports established
- Secure update-distribution path described; security updates without delay and free of charge (a different arrangement is possible for tailor-made products for business users)
- Cybersecurity risk assessment carried out and mapped to Annex I
- Support period defined (≥ 5 years or shorter expected time of use) and justified
- Standards/specifications/schemes applied named
- Test and inspection reports filed
- EU Declaration of Conformity per Annex V drawn up and added to the documentation
- CE marking affixed only after complete conformity assessment
- Retention process for ≥ 10 years / support period established
For an overview of the entire regulatory framework, see our CRA overview.
Frequently asked questions
Does the technical documentation have to be publicly accessible?+
Does the CRA mandate CycloneDX or SPDX for the SBOM?+
How long must I retain the documentation and the EU Declaration of Conformity?+
Do I need a notified body for the EU Declaration of Conformity?+
From when must the technical documentation, EU DoC and CE marking be in place?+
Sources
This content provides general technical and organizational information on the Cyber Resilience Act (Regulation (EU) 2024/2847) and does not constitute legal advice (no legal services within the meaning of the German RDG).