EU declaration of conformity generator for the Cyber Resilience Act

The EU declaration of conformity has the model structure set out in Annex V, contains the elements the relevant conformity assessment procedure in Annex VIII specifies, and is updated as appropriate (Article 28(2)); the generator’s optional revision line helps tell versions apart. Where a product falls under more than one Union act that requires a declaration, one declaration covers all of them and names each act with its publication reference (Article 28(3)). Drawing it up is how the manufacturer takes responsibility for the product’s compliance (Article 28(4)), and it is what the CE marking stands on.

Annex V lists what it must contain:

1. Name and type and any additional information enabling the unique identification of the product with digital elements
2. Name and address of the manufacturer or its authorised representative
3. A statement that the EU declaration of conformity is issued under the sole responsibility of the provider
4. Object of the declaration (identification of the product with digital elements allowing traceability, which may include a photograph, where appropriate)
5. A statement that the object of the declaration described above is in conformity with the relevant Union harmonisation legislation
6. References to any relevant harmonised standards used or any other common specification or cybersecurity certification in relation to which conformity is declared
7. Where applicable, the name and number of the notified body, a description of the conformity assessment procedure performed and identification of the certificate issued
8. Additional information:

Signed for and on behalf of:(place and date of issue):(name, function) (signature):

Point 3 of the annex says “provider”. The regulation has no provider role and places responsibility on the manufacturer, so the generated declaration says manufacturer. Point 7 applies only where a notified body was involved; under internal control it is not applicable.

A manufacturer ships either a copy of the full declaration or a simplified one with the product. The simplified declaration must give the exact internet address where the full one can be read (Article 13(20)). Annex VI sets its wording:

Hereby, … [name of manufacturer] declares that the product with digital elements type … [designation of type of product with digital element] is in compliance with Regulation (EU) 2024/2847 (1).

The full text of the EU declaration of conformity is available at the following internet address: …

(1) OJ L, 2024/2847, 20.11.2024, ELI: http://data.europa.eu/eli/reg/2024/2847/oj.

Either form has to be available in the languages required by the Member State where the product is placed or made available on the market (Article 28(2)).

The declaration is only as good as the technical documentation behind it. It is drawn up before the product is placed on the market, kept up to date at least for the support period (Article 31(2)), and held with the declaration for at least ten years or the support period, whichever is longer (Article 13(13)). Annex VII sets the minimum, as applicable to the product:

1. 1.a general description of the product with digital elements, including:

   • (a)its intended purpose;
   • (b)versions of software affecting compliance with essential cybersecurity requirements;
   • (c)where the product with digital elements is a hardware product, photographs or illustrations showing external features, marking and internal layout;
   • (d)user information and instructions as set out in Annex II;

2. 2.a description of the design, development and production of the product with digital elements and vulnerability handling processes, including:

   • (a)necessary information on the design and development of the product with digital elements, including, where applicable, drawings and schemes and a description of the system architecture explaining how software components build on or feed into each other and integrate into the overall processing;
   • (b)necessary information and specifications of the vulnerability handling processes put in place by the manufacturer, including the software bill of materials, the coordinated vulnerability disclosure policy, evidence of the provision of a contact address for the reporting of the vulnerabilities and a description of the technical solutions chosen for the secure distribution of updates;
   • (c)necessary information and specifications of the production and monitoring processes of the product with digital elements and the validation of those processes;

3. 3.an assessment of the cybersecurity risks against which the product with digital elements is designed, developed, produced, delivered and maintained pursuant to Article 13, including how the essential cybersecurity requirements set out in Part I of Annex I are applicable;

4. 4.relevant information that was taken into account to determine the support period pursuant to Article 13(8) of the product with digital elements;

5. 5.a list of the harmonised standards applied in full or in part the references of which have been published in the Official Journal of the European Union, common specifications as set out in Article 27 of this Regulation or European cybersecurity certification schemes adopted pursuant to Regulation (EU) 2019/881 pursuant to Article 27(8) of this Regulation, and, where those harmonised standards, common specifications or European cybersecurity certification schemes have not been applied, descriptions of the solutions adopted to meet the essential cybersecurity requirements set out in Parts I and II of Annex I, including a list of other relevant technical specifications applied. In the event of partly applied harmonised standards, common specifications or European cybersecurity certification schemes, the technical documentation shall specify the parts which have been applied;

6. 6.reports of the tests carried out to verify the conformity of the product with digital elements and of the vulnerability handling processes with the applicable essential cybersecurity requirements as set out in Parts I and II of Annex I;

7. 7.a copy of the EU declaration of conformity;

8. 8.where applicable, the software bill of materials, further to a reasoned request from a market surveillance authority provided that it is necessary in order for that authority to be able to check compliance with the essential cybersecurity requirements set out in Annex I.

The software bill of materials appears twice: as part of the vulnerability handling documentation in point 2(b), and in point 8, which covers handing it to a market surveillance authority on a reasoned request.

Who signs the EU declaration of conformity?

Someone signing for and on behalf of the manufacturer, giving their name and function, with the place and date of issue. An authorised representative can be named, but responsibility stays with the manufacturer.

Does a product under the Radio Equipment Directive need two declarations?

No. Where several Union acts each require a declaration, the manufacturer draws up a single declaration that identifies all of them with their publication references.

Do I need a notified body to issue the declaration?

No — the manufacturer always issues it. Whether a notified body is involved in the assessment behind it depends on the product’s class. A default-category product can use internal control, and so can an important Class I product where harmonised standards, common specifications or a European cybersecurity certification scheme are applied in full (Article 32(2)); otherwise a notified body takes part. The applicability checker works out which route applies.

When does the declaration have to exist?

Before the product is placed on the market, for products placed from 11 December 2027, when the CRA’s product requirements apply (Article 71(2)). A product placed on the market before then needs one only if it is substantially modified after that date (Article 69(2)). See the CRA timeline.