EU Cyber Resilience Act Article 31 and Annex VII Technical Documentation and Audit File

Treat Annex VII as the table of contents for the CRA technical file. The file should identify the product, show the versions that affect cybersecurity conformity, explain the intended purpose, and include the user information and instructions required by Annex II.

For hardware products, Annex VII also expects photographs or illustrations that show external features, marking, and internal layout. For software and connected products, the same section should clearly identify release lines, in-scope remote data processing, and the product boundary used for the risk assessment.

The audit file should not merely say that Annex I was considered. It should show the cybersecurity risks against which the product is designed, developed, produced, delivered, and maintained, and then explain how each applicable Annex I Part I requirement is implemented.

The Commission FAQ clarifies that the cybersecurity risk assessment covers the whole product with digital elements, including remote data processing when in scope, and supports planning, design, development, production, delivery, and maintenance. Keep the assessment tied to intended purpose, reasonably foreseeable use, conditions of use, and the time the product is expected to be in use.

Annex VII makes vulnerability handling part of the technical documentation, not a separate security operations appendix. The file should include the SBOM, coordinated vulnerability disclosure policy, evidence of a vulnerability reporting contact address, and the technical solution chosen for secure update distribution.

Annex I Part II adds the operating evidence: identified and documented vulnerabilities and components, remediation and security updates, regular tests and reviews, fixed-vulnerability disclosures, coordinated disclosure, vulnerability reporting channels, secure update distribution, and advisory messages for users.

Article 32 and Annex VIII determine how the file is used in conformity assessment. Under Module A, the manufacturer draws up the Annex VII technical documentation and declares conformity on its own responsibility. Under Module B+C or Module H, notified-body material such as applications, certificates, evaluation reports, quality-system approvals, surveillance records, and vulnerability-handling audit records should sit beside the same Annex VII evidence.

Annex VIII requires the EU declaration of conformity and technical documentation to be kept at the disposal of national authorities for 10 years after the product is placed on the market or for the support period, whichever is longer. The Commission FAQ also notes that market surveillance authorities may request the documentation and that it must be comprehensive and clear.