Search every question across sub-FAQs

The declaration is the signed compliance statement; the technical documentation is the evidence file that shows how the product and the manufacturer's vulnerability-handling processes meet the applicable CRA requirements.

Annex VII requires the technical documentation to include, as applicable, the product description, software versions affecting compliance, design and development information, vulnerability-handling process specifications, the cybersecurity risk assessment, support-period rationale, applied standards or other solutions, test reports, and a copy of the EU Declaration of Conformity. A declaration that cites a standard, certification, or notified-body certificate should be traceable to the corresponding evidence in that technical file.

The manufacturer draws up the EU Declaration of Conformity and assumes responsibility for product compliance by doing so. A notified body, where involved, may issue certificates or approval decisions, but the declaration remains the manufacturer's responsibility statement.

An authorised representative can have declaration-related tasks only within the CRA mandate rules. At minimum, the mandate must allow the authorised representative to keep the EU Declaration of Conformity and technical documentation at the disposal of market surveillance authorities and provide information on request. The CRA does not let the authorised representative take over the manufacturer's core obligation to draw up the technical documentation before placement on the market.

Yes. Before placing a product on the market, importers must check that the manufacturer has carried out the appropriate conformity assessment, drawn up technical documentation, applied CE marking, and supplied the declaration required by Article 13(20). Importers must keep a copy of the EU Declaration of Conformity for at least 10 years after placement on the market or for the support period, whichever is longer.

Distributors must act with due care and, before making the product available, verify that the product bears the CE marking and that the manufacturer and importer have complied with the relevant documentation and accompanying-information obligations.

Yes. Where the product is subject to more than one Union legal act requiring an EU Declaration of Conformity, the CRA requires a single EU Declaration of Conformity covering all those acts and identifying them, including their publication references.

The Blue Guide and Commission FAQ explain that this single declaration can be organised as a dossier made up of the relevant individual declarations. That helps when one applicable Union act changes, but the public declaration package still needs to clearly identify every act it covers.

Not necessarily. The declaration must identify the product sufficiently for traceability, and Annex V refers to the product name, type, and other identifying information. The Commission FAQ explains that the declaration is linked to the individual product, but it does not need to include each unit's unique identifier.

In practice, the same declaration version may cover many products manufactured in series if it still accurately identifies the covered product model or version and the conformity basis has not changed.

The CRA says the declaration must be updated as appropriate. The Blue Guide gives practical examples: a change in applicable legislation, a change in the versions of harmonised standards, or a change in the manufacturer or authorised representative contact details can require an update for products placed on the market after that change.

CRA teams should also review the declaration when a product version changes, when a substantial modification creates a new conformity situation, when the chosen conformity assessment basis changes, when a certificate reference changes, or when the technical documentation is updated in a way that affects the declared compliance basis.

Manufacturers must keep the technical documentation and EU Declaration of Conformity available to market surveillance authorities for at least 10 years after the product has been placed on the market or for the support period, whichever is longer.

The same retention period appears for authorised representatives where their mandate covers keeping the declaration and technical documentation, and for importers keeping a copy of the declaration. This means the declaration archive should be tied to product placement records and support-period records, not just to the initial release date.

No. The declaration records the conformity basis; it does not create presumption of conformity by merely naming a standard. Under the CRA, presumption of conformity depends on the relevant Article 27 route, such as correctly applying harmonised standards whose references have been published in the Official Journal, applicable common specifications, or qualifying European cybersecurity certification schemes.

The Blue Guide is explicit that referencing a harmonised standard in the declaration without applying that standard, or the relevant parts of it, does not start presumption of conformity. If only part of a standard is applied, the technical documentation should show what was applied and how the remaining applicable CRA requirements were met.

A useful declaration control set links each declaration version to the product model or software version covered, the conformity assessment route, the technical documentation version, the cybersecurity risk assessment, the support-period rationale, the list of standards or other specifications applied, test reports, notified-body certificates where applicable, and the public or customer-facing URL used for the simplified declaration.

Keep an approval record showing who signed the declaration and why the evidence was sufficient. When a release, standard, certificate, manufacturer address, or conformity route changes, review whether the declaration and simplified-declaration URL need a new version. This is evidence discipline, not a separate CRA legal form, but it is the practical way to show that the signed declaration matches the technical file and the product being supplied.

Under the CRA, a missing EU Declaration of Conformity or an incorrectly drawn-up declaration is formal non-compliance. The market surveillance authority must require the relevant manufacturer to end the non-compliance.

If the formal non-compliance persists, the Member State must take appropriate measures to restrict or prohibit the product from being made available on the market, or ensure that it is recalled or withdrawn. Article 58 also treats missing or incomplete technical documentation and CE-marking failures as formal non-compliance.

Under the CRA, an economic operator means the manufacturer, authorised representative, importer, distributor, or another natural or legal person that is subject to obligations relating to the manufacture of products with digital elements or to their making available on the market under the Regulation.

The CRA defines them as separate roles:

- the manufacturer develops, manufactures, or has the product designed, developed or manufactured, and markets it under its own name or trademark

- the authorised representative is an EU-established person with a written mandate from the manufacturer to act on specified tasks

- the importer is an EU-established person who places on the market a product bearing the name or trademark of a person established outside the Union

- the distributor is a person in the supply chain, other than the manufacturer or importer, who makes the product available on the Union market without affecting its properties

Yes.

The CRA recognises that the same business can perform different functions depending on the product and the service it provides. A business that only provides online intermediation for one product may not be a CRA economic operator for that product, while the same business could still be a distributor or a manufacturer for other products that it actually sells or brands.

Yes.

The CRA definition covers both the actor that developed or assembled the product and the business that markets it under its own name or trademark. A business that places the product on the market under its own brand takes the manufacturer role for CRA purposes.

Not in every case.

Article 18 says a manufacturer may appoint an authorised representative by written mandate, so the appointment is optional under the CRA itself. But where the manufacturer is established outside the Union, a CRA-covered product can only be placed on the Union market if there is an EU-established operator performing the tasks required by Article 4 of Regulation (EU) 2019/1020.