CRA declaration of conformity and technical documentation, explained

Regulation (EU) 2024/2847 has eight annexes in total — a count worth getting right, since earlier guidance (including other CRA explainers on this site covering Annex I's essential requirements, Annex II's user-information requirements, and Annex III/IV's important/critical product classifications) sometimes stops short of the full structure. Annex V is the full EU declaration of conformity template; Annex VI is a simplified version available only in the narrower cases Article 13(20) describes; Annex VII is the content of the technical documentation; and Annex VIII sets out the conformity assessment procedures (Modules A, B+C and H). The European Commission's own CRA summary page confirms this split directly, describing Annexes V and VI as providing "the model structure for such declaration, including a simplified version," with separate headed sections for "Technical Documentation (Annex VII)" and "Conformity Assessment Procedures (Annex VIII)."

Under Article 28 and the Annex V model, the declaration of conformity must identify the product (name, type and other identifying information); name and address the manufacturer or its authorised representative; state that it is issued under the sole responsibility of the provider; describe the object of the declaration with enough detail to trace it back to the specific product (optionally including a photograph); declare conformity with the relevant Union harmonisation legislation; cite any harmonised standards, common specifications or certifications relied on; where a notified body was involved, name it and describe the assessment procedure and certificate number used; and close with a signature block. Article 28 ties this directly back to Annex VIII, requiring the declaration to "contain the elements specified in the relevant conformity assessment procedures" — so the declaration's exact content depends on which module a product went through. The simplified Annex VI version exists specifically for the Article 13(20) cases and is not a general shortcut available to every manufacturer.

Annex VII, read with Article 31, is the more operationally demanding of the two. It requires: a general product description (intended purpose, which software versions affect compliance, external-feature photos or diagrams, and the Annex II user information); design, development and production information — including, explicitly, "the software bill of materials" and "the coordinated vulnerability disclosure policy" as required elements of the vulnerability-handling documentation, alongside production and monitoring process validation; the cybersecurity risk assessment required under Annex I; the stated basis for the manufacturer's determined support period under Article 13(8); the harmonised standards or alternative specifications applied; test reports; a copy of the declaration of conformity itself; and the SBOM, to be handed over on a market surveillance authority's reasoned request rather than published by default. The underlying SBOM format requirement — "a commonly used and machine-readable format covering at the very least the top-level dependencies" — is actually set in Annex I, Part II(1), not Annex VII, with Article 13(24) reserving the Commission's right to pin down the exact format later through an implementing act. Our guides to SBOM minimum elements and firmware SBOM cover what building that artifact actually involves for an embedded device.

Annex VIII defines three modules — Module A (internal control: the manufacturer self-assesses and self-declares), Module B+C (EU-type examination by a notified body, followed by conformity-to-type via internal production control) and Module H (full quality assurance, where a notified body assesses the manufacturer's quality management system as a whole) — and Article 32 routes a given product to one of them based on its Annex III/IV risk tier. Most "default" products can self-assess under Module A. "Important" products (Annex III, Class I and Class II) generally need B+C or H, or an equivalent certification scheme, rather than self-declaration alone. "Critical" products (Annex IV) require either a certification scheme or a specified fallback procedure. There is one narrower carve-out: free and open-source software manufacturers of important-tier software may self-assess if their technical documentation is made public — a point our guide to CRA open-source software steward obligations covers in more detail, since "open-source steward" obligations under the CRA are a separate category from this manufacturer-facing conformity-assessment question.

Per Article 71 and confirmed directly on the Commission's own summary page, the Regulation entered into force on 10 December 2024, twenty days after its 20 November 2024 Official Journal publication. From there, three dates matter in sequence: Article 14's active-exploitation and severe-incident reporting obligations apply from 11 September 2026; Chapter IV's notified-body designation provisions apply from 11 June 2026; and the Regulation's general provisions — including the Annex V/VI declaration of conformity, Annex VII technical documentation and CE-marking requirements this guide covers — apply from 11 December 2027. The Commission states this plainly: "Its main provisions will start applying from 11 December 2027," naming Article 14 and Chapter IV as the only earlier exceptions. For most device makers, that means the reporting obligation is already live, while the full declaration-of-conformity and technical-documentation paperwork has a longer runway — one best used now rather than in late 2027, since both the SBOM and the vulnerability-handling documentation Annex VII requires take real engineering time to produce accurately from an existing product line.

SoftWSP's device and firmware security assessments generate the SBOM and the vulnerability-handling evidence that Annex VII's technical documentation requires directly from a firmware image, so that documentation reflects what a device actually runs rather than what a build spec says it should run. See device & firmware security services for how that fits into CRA preparation ahead of the 2027 deadline.

This guide is based on Regulation (EU) 2024/2847's own text (Articles 13, 14, 28, 31, 32 and 71, and Annexes I and V through VIII) and the European Commission's own CRA summary and implementation-timeline pages, cross-checked against each other; EUR-Lex's own page returned an empty response to automated fetching during this guide's research, so the annex and article text above should be re-verified against eur-lex.europa.eu/eli/reg/2024/2847/oj directly before citing a specific clause in a compliance submission. This guide does not constitute legal advice.