Use this CRA FAQ to understand what Annex VII requires, when technical documentation must exist, how it must be kept up to date, and what authorities or notified bodies may request.
Built for compliance, engineering, certification, and legal teams preparing and maintaining CRA technical files.
Structured answer sets in this page tree.
Cited legal and guidance references.
CRA technical documentation is the evidence package behind the manufacturer's conformity case. This FAQ explains what Annex VII requires, when the documentation must exist, how it must be updated during the support period, when documentation can be reused across products or laws, and how language and authority-access rules work in practice.
CRA technical documentation is the evidence package that shows how the manufacturer ensured that the product and the manufacturer's processes comply with the applicable essential cybersecurity requirements.
It must contain all relevant data or details of the means used by the manufacturer to ensure compliance and must at least contain the elements listed in Annex VII.
Article 31(1), Annex VII
section 6.6
Research Copilot can turn EU Cyber Resilience Act FAQ Technical Documentation into a reusable cited workflow for teams implementing EU Cyber Resilience Act FAQ.
Start from EU Cyber Resilience Act FAQ Technical Documentation and move to source-backed decisions and evidence workflows.
Review evidence gaps, ownership, and next steps for EU Cyber Resilience Act FAQ.
It must be drawn up before the product is placed on the market.
It must then be continuously updated, where appropriate, at least during the support period.
The Commission FAQ adds that it has to be available when the product is placed on the market, regardless of where it is physically stored.
Article 13(12), Article 31(2)
section 4.1.8
Annex VII requires, as applicable:
- a general description of the product, including intended purpose, compliance-relevant software versions, hardware images or illustrations where relevant, and user information and instructions
- a description of design, development, production, and vulnerability handling processes
- the cybersecurity risk assessment and applicability of Annex I Part I requirements
- the information used to determine the support period
- the list of harmonised standards, common specifications, or certification schemes applied, and descriptions of alternative solutions where they were not applied
- test reports
- a copy of the EU declaration of conformity
- where applicable, the software bill of materials
Annex VII
Yes.
Article 13(4) requires the manufacturer to include the cybersecurity risk assessment in the technical documentation when placing the product on the market. The same provision also requires a clear justification where certain essential cybersecurity requirements are not applicable to the product.
Article 13(4), Annex VII point 3
section 4.1.8
Yes.
Annex VII expressly requires:
- versions of software affecting compliance with essential cybersecurity requirements
- relevant information taken into account to determine the support period under Article 13(8)
Those are not optional extras. They are part of the minimum CRA documentation set where applicable.
Annex VII points 1(b) and 4
The technical documentation must identify the harmonised standards, common specifications, and relevant certification schemes used in full or in part.
Where they were not applied, the documentation must describe the solutions adopted to meet the essential requirements and list any other relevant technical specifications used. If they were applied only in part, the documentation must specify which parts were applied.
Annex VII point 5
Yes, where Article 12 applies.
For CRA products that are also subject to other Union legal acts requiring technical documentation, Article 31(3) allows a single set of technical documentation containing both the CRA information and the information required by those other acts.
Article 31(3)
Yes.
The Commission FAQ says technical documentation may form part of the quality-system documentation where the manufacturer uses a quality-system-based conformity assessment route such as module H.
section 4.1.8
Article 31, Annex VIII Part IV point 3.1(b)
Article 31(4) says the technical documentation and correspondence relating to a conformity assessment procedure must be drawn up in an official language of the Member State in which the notified body is established or in a language acceptable to that body.
The Commission FAQ adds that the technical documentation can be written in any language, but if a market surveillance authority requests it, it needs to be provided in a language easily understood by that authority.
Article 31(4), Article 13(22), Article 53
section 6.6
No, as a rule it does not.
The Commission FAQ states that there is no general obligation to make the technical documentation available to customers or the public. The specific CRA exception is Article 32(5), where a manufacturer of qualifying free and open-source software in an Annex III category relies on the CRA's special Article 32(5) rule and therefore has to make the technical documentation public at the time of placing on the market.
Article 32(5)
section 6.6
Manufacturers must, on reasoned request, provide authorities with the information and documentation necessary to demonstrate conformity. Article 53 goes further and says authorities may be granted access to the data needed to assess design, development, production, and vulnerability handling, including related internal documentation.
For SBOMs, the CRA does not require public release, but Annex VII and Annex I make them part of the documentation framework and market surveillance authorities may request them where necessary to check compliance.
Article 13(22), Article 53, Annex I Part II point 1, Annex VII points 2(b) and 8, recital 77
section 4.1.8
Yes.
Article 31(2) requires continuous updating where appropriate, at least during the support period. The March 2026 draft guidance adds that technical documentation must remain accurate, complete, and up to date even where updates do not amount to substantial modifications.
For substantial modifications, the draft guidance, relying on the Blue Guide, says the documentation has to be updated to the extent the modification affects the applicable requirements, and unchanged aspects do not need to be retested or redocumented.
Article 31(2)
section 4.3 and section 2.1
points 106, 109-110
Not necessarily.
The March 2026 draft guidance says that for products designed before the CRA's application date, the obligation to provide evidence in the conformity assessment should not be read as requiring the manufacturer to recreate original design and development test evidence where that would not improve the product's security. The manufacturer still has to demonstrate current compliance through the cybersecurity risk assessment and technical documentation.
Article 13(12), Article 31, Annex VII point 6
points 34-35
Yes.
Article 33(5) says microenterprises and small enterprises may provide the Annex VII elements using a simplified format once the Commission specifies that form by implementing act. Notified bodies must accept that form for conformity assessment purposes.
Article 33(5)
No.
The CRA prescribes what the technical documentation must contain, mainly through Annex VII, but it does not impose one mandatory template or filing structure. What matters is that the file contains the required content and is clear enough to let a notified body or market surveillance authority assess conformity.
In practice, that means the manufacturer has flexibility in how the file is organised, but not in whether the required elements are actually present and kept up to date.
Article 31, Annex VII
section 6.6
Yes.
The Commission FAQ says that where a product has been redesigned or reassessed, the technical documentation must reflect all versions of the product, describe the changes made, explain how the versions can be identified, and include information on the relevant conformity assessment.
That matters in practice because the CRA documentation is meant to remain usable throughout the product's life. A manufacturer cannot keep only the newest file if that makes it impossible to tell which documentation applies to which version placed on the market.
Article 31(2), Annex VII point 1
section 4.1.8
section 4.3
Not automatically.
The March 2026 draft guidance allows a single set of technical documentation where the variants share the same architecture, security-relevant design, intended purpose, and cybersecurity risks, and where all relevant risks and essential requirements are adequately covered. If differences between variants affect cybersecurity properties, those differences must be reflected in the technical documentation and, where necessary, the conformity assessment.
points 158-161
Article 31, Annex VII
Yes, but each product still needs its own declaration of that reliance.
The March 2026 draft guidance says manufacturers should indicate in the technical documentation that the product has RDPS or relies on relevant third-party cloud solutions, and describe those solutions. If the same RDPS supports several products, the RDPS must be declared in each product's technical documentation, even though the RDPS documentation itself may be reused across product conformity assessments.
point 188
Article 31, Annex VII
No.
The January 2026 Commission FAQ and Article 53 make clear that, where necessary to assess conformity, market surveillance authorities may be granted access to the data needed to assess design, development, production, and vulnerability handling, including related internal documentation of the relevant economic operator. So the non-public character of the technical documentation does not cap authority access at the bare Annex VII file.
Article 53
sections 4.1.8 and 6.6
Yes, in principle.
Inference from the CRA text and Commission FAQ: the legal requirement is that the technical documentation be drawn up, contain the required Annex VII content, be available when the product is placed on the market, and be provided to authorities on reasoned request. The CRA does not prescribe one storage location or one physical dossier, but the manufacturer remains responsible for being able to assemble and provide a coherent, complete set when needed.
Article 13(12), Article 13(22), Article 31(1)
sections 4.1.8 and 6.6
No.
Article 31(4) deals with the language of technical documentation and correspondence relating to a conformity assessment procedure, especially for notified-body interactions. Separately, Article 13(22) requires manufacturers to provide the necessary information and documentation to market-surveillance authorities in a language that can be easily understood by the requesting authority. The Commission FAQ makes the same distinction.
Article 31(4), Article 13(22)
section 6.6