Use this CRA FAQ to understand what the EU declaration of conformity is, what it must contain, when the simplified form can be used, and what manufacturers, importers, distributors, and authorised representatives must do.
Built for compliance, legal, certification, product, and launch teams preparing CRA market-access documentation.
Structured answer sets in this page tree.
Cited legal and guidance references.
The EU declaration of conformity is a core CRA market-access document. This FAQ focuses on the two allowed formats, mandatory contents, language and retention rules, update triggers, and what happens when declaration requirements are missed.
It is the document in which the manufacturer states that fulfilment of the applicable CRA essential cybersecurity requirements has been demonstrated and assumes responsibility for the product's compliance.
Article 28(1) and 28(4)
section 6.8
Research Copilot can turn EU Cyber Resilience Act FAQ Declaration of Conformity into a reusable cited workflow for teams implementing EU Cyber Resilience Act FAQ.
Start from EU Cyber Resilience Act FAQ Declaration of Conformity and move to source-backed decisions and evidence workflows.
Review evidence gaps, ownership, and next steps for EU Cyber Resilience Act FAQ.
No.
Under the CRA, the manufacturer must first complete the relevant conformity assessment with a positive result and then draw up the EU declaration of conformity before placing the product on the market. The product must also be accompanied by either the full declaration or the simplified declaration.
Article 13(12), Article 13(20), Article 28(1)
section 6.8
Two formats are allowed:
- the full EU declaration of conformity using the Annex V structure
- the simplified EU declaration of conformity using the Annex VI wording and an internet address where the full text can be accessed
Article 13(20), Article 28(2), Annex V, Annex VI
section 6.8
Annex V requires at least:
- the product name, type and identifying information
- the manufacturer or authorised representative name and address
- a statement of sole responsibility
- identification of the product that is the object of the declaration
- a statement of conformity with the relevant Union harmonisation legislation
- references to relevant harmonised standards, common specifications or cybersecurity certification used
- where applicable, the notified body's name and number, the conformity assessment procedure performed, and the certificate identification
- any additional information, plus place, date, name, function and signature details
Annex V
The simplified declaration must follow the Annex VI wording. It states that the named product type is in compliance with Regulation (EU) 2024/2847 and must include the exact internet address where the full text of the EU declaration of conformity is available.
Article 13(20), Annex VI
Both the full and simplified declaration must be made available in the language or languages required by the Member State in which the product is placed on the market or made available on the market.
Article 28(2)
section 4.4
Under the CRA, the manufacturer draws up the EU declaration of conformity. By doing so, the manufacturer assumes responsibility for the product's compliance.
Even where a notified body has been involved in the conformity assessment, the declaration remains the manufacturer's document. An authorised representative may keep it and provide it to authorities if the mandate allows that, but the CRA does not shift the manufacturer's underlying responsibility.
Article 18(2)-(3), Article 28(1) and 28(4)
section 6.8
Yes.
Importers must ensure that the product is accompanied by the declaration required by Article 13(20), and they must keep a copy of the full EU declaration of conformity at the disposal of market surveillance authorities for at least 10 years after placement on the market or for the support period, whichever is longer. Distributors must verify that the manufacturer and importer have complied with the relevant documentation obligations before making the product available on the market.
Article 19(2)(c), Article 19(6), Article 20(2)(b)
Not necessarily.
Where more than one Union legal act requires an EU declaration of conformity, the CRA requires a single EU declaration of conformity covering all those acts. The Commission FAQ and the Blue Guide add that, for administrative reasons, this single declaration may be organised as a dossier containing the relevant individual declarations.
Article 28(3), recital 88
section 6.8
section 4.4
No, not necessarily.
The declaration has to identify the product sufficiently for traceability, but the Commission FAQ says it is not necessary for the declaration to include the unique identifier of each unit. In practice, the same version of a declaration can apply to many products manufactured in series, provided the declaration still correctly identifies the products covered by it.
Annex V, points 1 and 4
section 6.8
section 4.4
It must be updated whenever one of its relevant elements changes.
That can include, for example:
- a new product version or other change that affects the conformity basis
- a substantial modification that leads to a new conformity assessment
- changes in the applicable Union legislation cited
- changes in the harmonised standards, common specifications or certificate references relied on
- changes in the manufacturer or authorised representative details stated in the declaration
Article 13(14), Article 28(2), Annex V
section 6.8
section 4.4
In those cases, the person who becomes the manufacturer for CRA purposes must take over the corresponding conformity obligations, including the declaration of conformity.
That means a new declaration may be required for the modified product, even where some existing tests or technical documentation can still be reused for unaffected aspects.
Article 21, Article 22, Article 28
section 2.1
Manufacturers must keep the EU declaration of conformity at the disposal of market surveillance authorities for at least 10 years after the product has been placed on the market or for the support period, whichever is longer.
Where applicable, the authorised representative must be able to keep it under its mandate, and importers must also keep a copy for the same period.
Article 18(3)(a), Article 19(6), Article 13(13), Annex VIII Part I point 4.2
section 4.4
Yes.
If the manufacturer provides the simplified declaration with the product, it must contain the exact internet address at which the full EU declaration of conformity can be accessed.
Article 13(20), Annex VI
Yes.
The CRA still requires the manufacturer to draw up the EU declaration of conformity under Article 28 before the product is placed on the market. Article 13(20) only gives the manufacturer a choice about what accompanies the product: either a copy of the full declaration or the simplified declaration. The simplified declaration is therefore not a substitute for creating the full declaration in the first place.
Article 13(12), Article 13(20), Article 28(1)-(2), Annex VI
section 6.8
No.
Where the product is subject to more than one Union legal act requiring an EU declaration of conformity, the CRA requires a single declaration covering all of them. That declaration must identify the Union legal acts concerned, including their publication references. The single declaration may still be organised as a dossier containing the relevant individual declarations.
Article 28(3), recital 88
section 6.8
section 4.4
No.
The declaration records the basis on which conformity is declared, but presumption of conformity comes from the underlying legal conformity route, such as correctly applying a relevant harmonised standard whose reference is published in the Official Journal, a common specification, or a qualifying European cybersecurity certification scheme. The Blue Guide expressly says that merely referencing a harmonised standard in the EU declaration of conformity without actually applying that standard, or the relevant parts of it, does not create presumption of conformity.
Article 27, Annex V point 6
section 4.1.2.2 and footnote 188
Under the CRA, that is formal non-compliance.
Article 58 says the market surveillance authority must require the manufacturer to put an end to the non-compliance where the EU declaration of conformity has not been drawn up or has not been drawn up correctly. If the non-compliance persists, the Member State must take appropriate measures to restrict or prohibit the product from being made available on the market or ensure that it is recalled or withdrawn.
Article 58(1)(c)-(d) and Article 58(2)
Yes, but only within the limits of the CRA mandate rules.
Article 18 requires the mandate to allow the authorised representative at least to keep the EU declaration of conformity and provide it to market surveillance authorities. In addition, Annex VIII expressly allows the authorised representative, in certain conformity assessment procedures, to fulfil the declaration and CE-marking obligations on the manufacturer's behalf and under its responsibility if the mandate says so. But the CRA does not transfer the manufacturer's underlying responsibility for compliance, and Article 18(2) still makes the core Article 13(12), first-subparagraph obligations non-delegable.
Article 18(2)-(3), Article 28(4), Annex VIII Part I point 5, Annex VIII Part III point 4