--- title: "CRA Declaration of Conformity FAQ" canonical_url: "https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/declaration-of-conformity" source_url: "https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/declaration-of-conformity" author: "Sorena AI" description: "FAQ on the Cyber Resilience Act EU Declaration of Conformity: Annex V contents, simplified Annex VI wording, CE marking link, technical documentation, retention, updates, and operator duties." published_at: "2026-03-10" updated_at: "2026-03-10" keywords: - "CRA declaration of conformity" - "CRA Annex V" - "CRA Annex VI" - "Cyber Resilience Act CE marking" - "CRA technical documentation" - "Cyber Resilience Act" - "CRA FAQ" - "EU Declaration of Conformity" - "CE marking" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # CRA Declaration of Conformity FAQ FAQ on the Cyber Resilience Act EU Declaration of Conformity: Annex V contents, simplified Annex VI wording, CE marking link, technical documentation, retention, updates, and operator duties. *FAQ* *EU* *Cyber Resilience Act* ## EU Cyber Resilience Act FAQ Declaration of Conformity This FAQ helps understand the CRA EU Declaration of Conformity, what the full and simplified versions must contain, how it connects to CE marking and conformity assessment, and what evidence should support it. Built for product, compliance, legal, certification, and release teams preparing CRA market-access documentation. The EU Declaration of Conformity is the manufacturer's formal CRA statement that the applicable essential cybersecurity requirements have been demonstrated. It is not just a launch formality: it sits after conformity assessment, supports CE marking, must match the technical documentation, and has to remain available to authorities. ## What is the CRA EU Declaration of Conformity? It is the document in which the manufacturer declares that the product with digital elements complies with the Cyber Resilience Act and takes responsibility for that compliance. For CRA purposes, the declaration states that fulfilment of the applicable essential cybersecurity requirements in Annex I has been demonstrated. It should therefore be consistent with the conformity assessment route, the technical documentation, the cybersecurity risk assessment, and any harmonised standards, common specifications, cybersecurity certifications, or notified-body certificates relied on. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 28(1) and 28(4) define the declaration and manufacturer responsibility. - [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 6.8 explains the declaration as the manufacturer's compliance statement. ## Can a CRA product be placed on the market without a Declaration of Conformity? No. Before placing a product with digital elements on the market, the manufacturer must draw up technical documentation, complete or have completed the chosen conformity assessment procedure, and, where conformity has been demonstrated, draw up the EU Declaration of Conformity and affix the CE marking. The product must also be accompanied by either a copy of the full EU Declaration of Conformity or a simplified EU Declaration of Conformity that points to the full text. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 13(12) links technical documentation, conformity assessment, the declaration, and CE marking before placement on the market. - [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 6.8 confirms that the declaration cannot be signed without a positive conformity assessment procedure. ## What CRA declaration formats are allowed? The CRA allows two customer-facing formats. The first is the full EU Declaration of Conformity, using the Annex V model structure. The second is the simplified EU Declaration of Conformity, using the Annex VI wording and giving the exact internet address where the full declaration can be accessed. The simplified version reduces what accompanies the product, but it does not remove the obligation to create and maintain the full EU Declaration of Conformity. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 13(20), Article 28(2), Annex V, and Annex VI establish the full and simplified formats. - [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 6.8 lists the two allowed declaration formats. ## What must the full Annex V Declaration of Conformity contain? Annex V requires enough information to identify the product and the compliance basis. The full declaration must include the product name, type, and identifying information; the manufacturer or authorised representative name and address; a sole-responsibility statement; the object of the declaration; and a statement that the product conforms with the relevant Union harmonisation legislation. It must also list the relevant harmonised standards, common specifications, or cybersecurity certification used, and, where applicable, the notified body's name and number, the conformity assessment procedure performed, and the certificate issued. The signature block should identify the place and date of issue, name, function, and signature. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Annex V lists the mandatory information in the full EU Declaration of Conformity. ## What must the simplified Annex VI declaration contain? The simplified declaration must follow the Annex VI model. It names the manufacturer, identifies the product type, states that the product is in compliance with Regulation (EU) 2024/2847, and gives the internet address where the full EU Declaration of Conformity is available. Teams using the simplified version should control that URL like a release artifact: it should resolve to the current full declaration for the product version being supplied, remain stable for authority checks, and be updated when the underlying declaration changes. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 13(20) and Annex VI require the simplified declaration to include the exact internet address for the full text. ## How does the Declaration of Conformity relate to CE marking? The CE marking and the declaration are linked outputs of the same market-access sequence. The manufacturer affixes the CE marking only after the relevant conformity assessment procedure has demonstrated conformity and the EU Declaration of Conformity has been drawn up. For physical products, the CE marking must generally be placed visibly, legibly, and indelibly on the product. Where that is not possible or not warranted, it goes on the packaging and on the accompanying EU Declaration of Conformity. For software products, the CE marking may be placed either on the EU Declaration of Conformity or on the website accompanying the software product, with the relevant website section easily and directly accessible to consumers. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 13(12) and Article 30 connect conformity assessment, the declaration, and CRA CE-marking placement rules. - [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 6.7 explains CE marking as a manufacturer self-declaration addressed to consumers and market surveillance authorities. ## How does the Declaration of Conformity relate to technical documentation? The declaration is the signed compliance statement; the technical documentation is the evidence file that shows how the product and the manufacturer's vulnerability-handling processes meet the applicable CRA requirements. Annex VII requires the technical documentation to include, as applicable, the product description, software versions affecting compliance, design and development information, vulnerability-handling process specifications, the cybersecurity risk assessment, support-period rationale, applied standards or other solutions, test reports, and a copy of the EU Declaration of Conformity. A declaration that cites a standard, certification, or notified-body certificate should be traceable to the corresponding evidence in that technical file. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 31 and Annex VII define the technical documentation contents, including a copy of the EU Declaration of Conformity. - [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 4.1.8 explains that technical documentation must demonstrate conformity regardless of conformity assessment route. ## Who draws up the declaration, and who remains responsible? The manufacturer draws up the EU Declaration of Conformity and assumes responsibility for product compliance by doing so. A notified body, where involved, may issue certificates or approval decisions, but the declaration remains the manufacturer's responsibility statement. An authorised representative can have declaration-related tasks only within the CRA mandate rules. At minimum, the mandate must allow the authorised representative to keep the EU Declaration of Conformity and technical documentation at the disposal of market surveillance authorities and provide information on request. The CRA does not let the authorised representative take over the manufacturer's core obligation to draw up the technical documentation before placement on the market. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 18 and Article 28 allocate manufacturer and authorised-representative declaration responsibilities. ## Do importers and distributors have declaration-related duties? Yes. Before placing a product on the market, importers must check that the manufacturer has carried out the appropriate conformity assessment, drawn up technical documentation, applied CE marking, and supplied the declaration required by Article 13(20). Importers must keep a copy of the EU Declaration of Conformity for at least 10 years after placement on the market or for the support period, whichever is longer. Distributors must act with due care and, before making the product available, verify that the product bears the CE marking and that the manufacturer and importer have complied with the relevant documentation and accompanying-information obligations. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 19(2), Article 19(6), and Article 20(2) set importer and distributor checks related to the declaration. ## If several EU product laws apply, can one declaration cover all of them? Yes. Where the product is subject to more than one Union legal act requiring an EU Declaration of Conformity, the CRA requires a single EU Declaration of Conformity covering all those acts and identifying them, including their publication references. The Blue Guide and Commission FAQ explain that this single declaration can be organised as a dossier made up of the relevant individual declarations. That helps when one applicable Union act changes, but the public declaration package still needs to clearly identify every act it covers. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 28(3) and recital 88 require a single declaration where several Union acts require one. - [The Blue Guide on the implementation of EU product rules 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Section 4.4 explains that a single declaration can be a dossier of relevant individual declarations. ## Does the declaration need a unique identifier for each individual unit? Not necessarily. The declaration must identify the product sufficiently for traceability, and Annex V refers to the product name, type, and other identifying information. The Commission FAQ explains that the declaration is linked to the individual product, but it does not need to include each unit's unique identifier. In practice, the same declaration version may cover many products manufactured in series if it still accurately identifies the covered product model or version and the conformity basis has not changed. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Annex V points 1 and 4 require product identification and traceability information. - [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 6.8 clarifies that a unique identifier for each individual product is not required in the declaration. ## When does the Declaration of Conformity need to be updated? The CRA says the declaration must be updated as appropriate. The Blue Guide gives practical examples: a change in applicable legislation, a change in the versions of harmonised standards, or a change in the manufacturer or authorised representative contact details can require an update for products placed on the market after that change. CRA teams should also review the declaration when a product version changes, when a substantial modification creates a new conformity situation, when the chosen conformity assessment basis changes, when a certificate reference changes, or when the technical documentation is updated in a way that affects the declared compliance basis. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 28(2) requires the declaration to be updated as appropriate; Article 13(14) requires series-production conformity procedures to account for relevant changes. - [The Blue Guide on the implementation of EU product rules 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Section 4.4 explains examples of declaration update triggers. ## How long must the CRA Declaration of Conformity be kept? Manufacturers must keep the technical documentation and EU Declaration of Conformity available to market surveillance authorities for at least 10 years after the product has been placed on the market or for the support period, whichever is longer. The same retention period appears for authorised representatives where their mandate covers keeping the declaration and technical documentation, and for importers keeping a copy of the declaration. This means the declaration archive should be tied to product placement records and support-period records, not just to the initial release date. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 13(13), Article 18(3)(a), and Article 19(6) set retention duties for manufacturers, authorised representatives, and importers. ## Does citing a harmonised standard in the declaration create presumption of conformity by itself? No. The declaration records the conformity basis; it does not create presumption of conformity by merely naming a standard. Under the CRA, presumption of conformity depends on the relevant Article 27 route, such as correctly applying harmonised standards whose references have been published in the Official Journal, applicable common specifications, or qualifying European cybersecurity certification schemes. The Blue Guide is explicit that referencing a harmonised standard in the declaration without applying that standard, or the relevant parts of it, does not start presumption of conformity. If only part of a standard is applied, the technical documentation should show what was applied and how the remaining applicable CRA requirements were met. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 27 defines CRA presumption-of-conformity routes; Annex V point 6 requires references to the relevant standards, specifications, or certifications used. - [The Blue Guide on the implementation of EU product rules 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Section 4.1.2.2 and footnote 188 distinguish applying a harmonised standard from merely citing it. ## What evidence controls should support a CRA declaration? A useful declaration control set links each declaration version to the product model or software version covered, the conformity assessment route, the technical documentation version, the cybersecurity risk assessment, the support-period rationale, the list of standards or other specifications applied, test reports, notified-body certificates where applicable, and the public or customer-facing URL used for the simplified declaration. Keep an approval record showing who signed the declaration and why the evidence was sufficient. When a release, standard, certificate, manufacturer address, or conformity route changes, review whether the declaration and simplified-declaration URL need a new version. This is evidence discipline, not a separate CRA legal form, but it is the practical way to show that the signed declaration matches the technical file and the product being supplied. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Annex VII identifies the evidence that should sit behind the declaration, including standards, test reports, cybersecurity risk assessment, and the declaration copy. - [The Blue Guide on the implementation of EU product rules 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Section 4.4 explains that declarations must be kept up to date when relevant elements change. ## What happens if the Declaration of Conformity is missing or incorrect? Under the CRA, a missing EU Declaration of Conformity or an incorrectly drawn-up declaration is formal non-compliance. The market surveillance authority must require the relevant manufacturer to end the non-compliance. If the formal non-compliance persists, the Member State must take appropriate measures to restrict or prohibit the product from being made available on the market, or ensure that it is recalled or withdrawn. Article 58 also treats missing or incomplete technical documentation and CE-marking failures as formal non-compliance. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 58 identifies missing or incorrectly drawn-up declarations as formal non-compliance and describes authority follow-up. ## Primary sources - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Official Cyber Resilience Act legal text supporting this FAQ and its article-level compliance conclusions. ## Topic Guides - [CRA Applicability Test for Products With Digital Elements](/artifacts/eu/cyber-resilience-act/applicability-test.md): Check whether the EU Cyber Resilience Act applies to a hardware, software, firmware, open-source, or connected product before conformity planning. - [CRA Article 14 Reporting Obligations for Vulnerabilities and Incidents](/artifacts/eu/cyber-resilience-act/reporting-obligations.md): Article 14 guide to CRA reports for actively exploited vulnerabilities and severe product-security incidents, including deadlines, CSIRT routing, users, and evidence. - [CRA Blue Guide Concepts FAQ | Placing on the Market, Making Available, Distance Sales](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md): CRA FAQ explaining Blue Guide market-access concepts for products with digital elements: placing on the market, making available, imports, CE marking, operator roles, online sales, stock, and testing exceptions. - [CRA CE Marking FAQ | Conformity Assessment, EU Declaration, Evidence](/artifacts/eu/cyber-resilience-act/faq/ce-marking.md): Practical CRA CE marking answers for products with digital elements: conformity assessment, EU declaration, technical documentation, standards, software placement, and launch evidence. - [CRA Component Due Diligence FAQ | Third-Party Software, FOSS, SBOMs](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md): Cyber Resilience Act FAQ on manufacturer due diligence for integrated components, third-party software, FOSS dependencies, SBOMs, vulnerability handling, and evidence records. - [CRA Conformity Assessment and CE Marking](/artifacts/eu/cyber-resilience-act/conformity-assessment-and-ce-marking.md): How to choose a Cyber Resilience Act conformity route, prepare technical documentation, issue the EU declaration of conformity, and affix CE marking. - [CRA Conformity Assessment Routes FAQ | Module A, Module B+C, Module H, Important and Critical Products](/artifacts/eu/cyber-resilience-act/faq/conformity-assessment-routes.md): Cyber Resilience Act FAQ on when manufacturers can use module A, when module B+C or module H is required, and how important and critical products affect the route. - [CRA Cybersecurity Risk Assessment FAQ | Article 13, Annex I, Updates](/artifacts/eu/cyber-resilience-act/faq/cybersecurity-risk-assessment.md): CRA FAQ on Article 13 cybersecurity risk assessments, Annex I applicability, intended purpose, foreseeable use, technical documentation, and update evidence. - [CRA deadlines and compliance calendar | EU Cyber Resilience Act](/artifacts/eu/cyber-resilience-act/deadlines-and-compliance-calendar.md): Track the Cyber Resilience Act entry into force, staged application dates, Article 14 reporting deadlines, transitional rules, and review dates. - [CRA Economic Operators FAQ | Manufacturers, Importers, Distributors, Authorised Representatives](/artifacts/eu/cyber-resilience-act/faq/economic-operators.md): CRA FAQ on economic-operator roles: manufacturers, importers, distributors, authorised representatives, substantial modification, traceability, and evidence controls. - [CRA Essential Cybersecurity Requirements FAQ | Annex I Part I and Part II](/artifacts/eu/cyber-resilience-act/faq/essential-cybersecurity-requirements.md): CRA FAQ on Annex I product cybersecurity requirements, vulnerability handling, secure-by-default design, risk assessment, documentation, lifecycle duties, and user information. - [CRA Essential Cybersecurity Requirements in Annex I](/artifacts/eu/cyber-resilience-act/essential-cybersecurity-requirements.md): An official source guide to the Cyber Resilience Act Annex I requirements for product security, vulnerability handling, secure-by-design controls, documentation, and evidence. - [CRA Hardware and Software Boundaries FAQ | Product Scope, Components, RDPS](/artifacts/eu/cyber-resilience-act/faq/hardware-software-boundaries.md): FAQ on Cyber Resilience Act hardware and software boundaries: combined products, standalone software, source code, components, remote data processing, SaaS and market-placement changes. - [CRA Harmonised Standards FAQ | Presumption of Conformity, Common Specifications](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md): Cyber Resilience Act FAQ on how harmonised standards, common specifications, certification schemes, and OJ publication affect CRA conformity evidence. - [CRA Important and Critical Products FAQ | Annex III, Annex IV, Conformity Assessment](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md): FAQ on CRA important and critical products, Annex III and Annex IV classification, core functionality, and conformity assessment consequences. - [CRA Integrated Components and Dependencies FAQ | Third-Party Software and SBOM Evidence](/artifacts/eu/cyber-resilience-act/faq/integrated-components-and-dependencies.md): Cyber Resilience Act FAQ on integrated components, third-party software, remote data processing, SBOM-style evidence, upstream fixes, FOSS dependencies, and manufacturer responsibility. - [CRA Interplay With EU Product Laws FAQ | RED, Machinery, Data Act](/artifacts/eu/cyber-resilience-act/faq/interplay-with-other-eu-laws.md): Official source CRA FAQ on overlap with the Radio Equipment Directive, Machinery Regulation, GPSR, Data Act, exclusions, declarations, documentation, and existing certificates. - [CRA Known Exploitable Vulnerabilities at Launch FAQ](/artifacts/eu/cyber-resilience-act/faq/known-exploitable-vulnerabilities-at-launch.md): FAQ for Cyber Resilience Act launch decisions: known exploitable vulnerabilities, CVEs, component flaws, secure-by-default settings, release gates, Article 14 reporting, and evidence. - [CRA Legacy Products FAQ | Pre-11 December 2027 Products](/artifacts/eu/cyber-resilience-act/faq/legacy-products.md): Cyber Resilience Act FAQ on products placed on the market before 11 December 2027, Article 14 reporting, substantial modification, distributor stock, spare parts, and records. - [CRA Manufacturer Obligations FAQ | Article 13, Annex I, CE Marking](/artifacts/eu/cyber-resilience-act/faq/manufacturer-obligations.md): FAQ for Cyber Resilience Act manufacturers covering Article 13 duties, risk assessment, Annex I, vulnerability handling, support periods, documentation, conformity assessment, reporting, CE marking, and evidence controls. - [CRA Market Surveillance and Enforcement FAQ | Authorities, Corrective Action, Safeguards](/artifacts/eu/cyber-resilience-act/faq/market-surveillance-and-enforcement.md): Cyber Resilience Act FAQ on market-surveillance authorities, investigations, corrective action, withdrawal, recall, safeguards, sweeps, documentation access, and penalties. - [CRA Module B+C FAQ | EU-Type Examination, Conformity to Type, Notified Bodies](/artifacts/eu/cyber-resilience-act/faq/module-b-c.md): CRA Module B+C FAQ explaining EU-type examination, conformity to type, notified-body evidence, production control, CE marking, declarations, and certificate changes. - [CRA Module H FAQ | Full Quality Assurance, Notified Body Surveillance, CE Marking](/artifacts/eu/cyber-resilience-act/faq/module-h.md): CRA Module H FAQ explaining the full-quality-assurance route, notified-body assessment, quality-system scope, technical documentation, CE marking, declarations, and records. - [CRA Notified Bodies FAQ | Scope, Modules B+C and H, Certificates](/artifacts/eu/cyber-resilience-act/faq/notified-bodies.md): Practical CRA FAQ on when notified bodies are needed, how CRA bodies are designated, what their notified scope means, and how Module B+C and Module H assessments work. - [CRA Open-Source Software FAQ | FOSS Scope, Stewards, Manufacturers](/artifacts/eu/cyber-resilience-act/faq/open-source-software.md): Cyber Resilience Act FAQ for free and open-source software: commercial activity, steward duties, manufacturer due diligence, vulnerability handling, public documentation, and user obligations. - [CRA Over-the-Air Updates FAQ](/artifacts/eu/cyber-resilience-act/faq/over-the-air-updates.md): Cyber Resilience Act FAQ on OTA updates, automatic security updates, secure update distribution, support-period evidence, and offline update paths. - [CRA penalties and fines FAQ | Article 64 fine caps](/artifacts/eu/cyber-resilience-act/faq/penalties-and-fines.md): FAQ on EU Cyber Resilience Act Article 64 penalties: maximum fine tiers, turnover caps, national enforcement, economic operators, reporting duties, and open-source steward carve-outs. - [CRA Penalties and Fines: Article 64 Caps and Enforcement Context](/artifacts/eu/cyber-resilience-act/penalties-and-fines.md): Article 64 of the EU Cyber Resilience Act sets administrative fine ceilings for Annex I, manufacturer, reporting, economic-operator, notified-body, and information-request breaches. - [CRA Product Families FAQ | Variants, Shared Assessments, Family Reuse, Conformity Scope](/artifacts/eu/cyber-resilience-act/faq/product-families.md): CRA FAQ on product families, variant grouping, shared technical documentation, conformity evidence, and when cybersecurity-relevant differences need separate assessment. - [CRA Products with Digital Elements Scope | EU Cyber Resilience Act](/artifacts/eu/cyber-resilience-act/products-with-digital-elements-scope.md): Apply the EU Cyber Resilience Act scope test for software, hardware, remote data processing, components, open-source software, exclusions, and economic-operator roles. - [CRA Products With Digital Elements Scope FAQ](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md): EU Cyber Resilience Act FAQ on products with digital elements, software, firmware, remote data processing, components, exclusions, market placement, and CRA operator boundaries. - [CRA Remote Data Processing Solutions FAQ | Product Scope, Cloud and Backend Boundaries](/artifacts/eu/cyber-resilience-act/faq/remote-data-processing-solutions.md): FAQ on how the EU Cyber Resilience Act treats remote data processing solutions, manufacturer-controlled backends, third-party cloud services, SaaS, risk assessment, documentation, and user information. - [CRA Reporting Obligations FAQ | Article 14, CSIRTs, ENISA, User Notices](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md): Cyber Resilience Act FAQ on Article 14 reporting for actively exploited vulnerabilities and severe incidents, including timing, CSIRT routing, ENISA access, user notices, and evidence. - [CRA Requirements | Annex I, Manufacturer Duties and CE Evidence](/artifacts/eu/cyber-resilience-act/requirements.md): Map Cyber Resilience Act requirements from Annex I to manufacturer duties, vulnerability handling, user information, technical documentation, declaration of conformity, and CE marking evidence. - [CRA SBOM and Vulnerability Management Template](/artifacts/eu/cyber-resilience-act/sbom-and-vulnerability-management-template.md): Build a CRA-ready SBOM and vulnerability handling record with component inventory, triage, remediation, disclosure, reporting, update, and technical documentation fields. - [CRA Secure-by-Default FAQ | Default Configuration and Annex I Controls](/artifacts/eu/cyber-resilience-act/faq/secure-by-default.md): Cyber Resilience Act FAQ on secure-by-default configuration, automatic security updates, attack surface reduction, authentication, data minimisation, user information, and tailor-made products. - [CRA Security Updates vs Functionality Updates FAQ](/artifacts/eu/cyber-resilience-act/faq/security-updates-vs-functionality-updates.md): Cyber Resilience Act FAQ on classifying security updates, functionality updates, support-period duties, automatic updates, user notices, and substantial-modification review. - [CRA Substantial Modification FAQ | Updates, Repairs, Manufacturer Duties](/artifacts/eu/cyber-resilience-act/faq/substantial-modification.md): Cyber Resilience Act FAQ on when software updates, repairs, spare parts, and post-market changes become substantial modifications and trigger CRA manufacturer, evidence, and conformity duties. - [CRA Support Period FAQ | Expected Product Lifetime, Security Updates, User Information](/artifacts/eu/cyber-resilience-act/faq/support-period.md): Practical CRA FAQ on how manufacturers determine support periods, disclose support end dates, keep security updates available, and document support-period evidence. - [CRA Tailor-Made Products FAQ | Bespoke Products, Market Placement, Evidence](/artifacts/eu/cyber-resilience-act/faq/tailor-made-products.md): FAQ on when a bespoke product may be treated as tailor-made under the EU Cyber Resilience Act, what the carve-out changes, and what manufacturers still need to document. - [CRA Technical Documentation FAQ | Annex VII Evidence and Technical File](/artifacts/eu/cyber-resilience-act/faq/technical-documentation.md): CRA FAQ explaining Annex VII technical documentation, risk assessment evidence, conformity assessment files, vulnerability handling records, product families, RDPS, language, and authority access. - [CRA Transition Period FAQ | Entry Into Force, Application Dates, Reporting, Legacy Products](/artifacts/eu/cyber-resilience-act/faq/transition-period.md): CRA FAQ on the transition period covering entry into force, 2026 reporting, 2027 application, legacy products, stock, customs timing, and software versions. - [CRA Update Availability and Software Archives FAQ](/artifacts/eu/cyber-resilience-act/faq/update-availability-and-archives.md): FAQ on CRA security-update availability, support-period notices, optional public software archives, historical versions, and Article 13(10) software-version limits. - [CRA User Information and Transparency FAQ | Annex II Instructions](/artifacts/eu/cyber-resilience-act/faq/user-information-and-transparency.md): Practical CRA FAQ on Annex II user instructions, support-period disclosure, vulnerability contacts, update notices, importer and distributor information. - [CRA vs RED Cybersecurity Delegated Act](/artifacts/eu/cyber-resilience-act/cra-vs-red-cybersecurity-delegated-act.md): Compare the EU Cyber Resilience Act with the RED cybersecurity delegated act for connected and radio equipment, including scope, timing, evidence, and transition treatment. - [CRA vs UK PSTI Act | Cyber Resilience Act Comparison](/artifacts/eu/cyber-resilience-act/cra-vs-uk-psti-act.md): Compare cited EU Cyber Resilience Act duties with UK PSTI planning points, with UK legal details clearly marked for separate source review. - [CRA Vulnerability Handling and Disclosure | Article 14 Reporting and Security Updates](/artifacts/eu/cyber-resilience-act/vulnerability-handling-and-disclosure.md): How EU Cyber Resilience Act manufacturers should run vulnerability intake, remediation, coordinated disclosure, Article 14 reporting, secure updates, and evidence records. - [CRA Vulnerability Handling FAQ | Support Periods, Components, Reporting](/artifacts/eu/cyber-resilience-act/faq/vulnerability-handling.md): Practical CRA FAQ on vulnerability handling: SBOMs, remediation, coordinated disclosure, component issues, security updates, support periods, Article 14 reporting, and user notices. - [Cyber Resilience Act Module A FAQ | Internal Production Control](/artifacts/eu/cyber-resilience-act/faq/module-a.md): FAQ on when CRA Module A internal production control is available, when it is blocked, and what documentation, testing, standards, and evidence it still requires. - [EU CRA Compliance Program for Manufacturers and Economic Operators](/artifacts/eu/cyber-resilience-act/compliance.md): Build a Cyber Resilience Act compliance program around product scope, Annex I security requirements, conformity assessment, technical documentation, vulnerability reporting, and market surveillance. - [EU Cyber Resilience Act Checklist for Product Security and CE Marking](/artifacts/eu/cyber-resilience-act/checklist.md): A CRA checklist for products with digital elements: scope, Annex I security controls, vulnerability handling, Article 14 reporting, technical documentation, conformity assessment, CE marking, and support-period evidence. - [EU Cyber Resilience Act Core Functionality FAQ | CRA Product Classification](/artifacts/eu/cyber-resilience-act/faq/core-functionality.md): CRA FAQ on core functionality, product boundaries, remote data processing, integrated components, ancillary functions, and software changes that affect product classification. - [EU Cyber Resilience Act FAQ](/artifacts/eu/cyber-resilience-act/faq.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. - [EU Cyber Resilience Act Repairs and Spare Parts FAQ](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md): CRA FAQ for repairs, spare parts, legacy products, security updates, substantial modification, and responsibility after product changes. - [EU Cyber Resilience Act Technical Documentation and Audit File](/artifacts/eu/cyber-resilience-act/technical-documentation-and-audit-file.md): Build an audit-ready CRA technical file around Article 31 and Annex VII: product scope, risk assessment, vulnerability handling, conformity evidence, testing, and retention. *Recommended next step* *Placement: after key answers* ## Use Research Copilot for CRA declaration evidence Research Copilot helps teams map CRA declaration questions to cited requirements, technical-documentation evidence, and release records. - [Open Research Copilot](/solutions/research-copilot.md): Trace CRA declaration fields to source text, conformity evidence, and release-control records. - [Talk through CRA declaration implementation](/contact.md): Review declaration ownership, simplified-declaration URLs, and technical-documentation evidence gaps. --- [Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/declaration-of-conformity