EU Cyber Resilience Act Article 31 and Annex VII Technical Documentation and Audit File

Treat Annex VII as the table of contents for the CRA technical file. The record must identify the product, show the versions that affect cybersecurity conformity, explain the intended purpose, and include the user information and instructions required by Annex II.

For hardware products, Annex VII also requires photographs or illustrations that show external features, marking, and internal layout. For software and connected products, the same section should clearly identify release lines, in-scope remote data processing, and the product boundary used for the risk assessment.

The audit file must show the cybersecurity risks against which the product is designed, developed, produced, delivered, and maintained, then explain how each applicable Annex I Part I requirement is implemented.

The Commission FAQ clarifies that the cybersecurity risk assessment covers the whole product with digital elements, including remote data processing when in scope, and supports planning, design, development, production, delivery, and maintenance. Keep the assessment tied to intended purpose, reasonably foreseeable use, conditions of use, and the time the product is expected to be in use. Article 13 also requires the manufacturer to document later cybersecurity information proportionately and update the risk assessment where applicable.

Annex VII makes vulnerability handling part of the technical documentation, not a separate security operations appendix. The record must include the SBOM, coordinated vulnerability disclosure policy, evidence of a vulnerability reporting contact address, and the technical solution chosen for secure update distribution.

Annex I Part II adds the operating evidence: identified and documented vulnerabilities and components, remediation and security updates, regular tests and reviews, fixed-vulnerability disclosures, coordinated disclosure, vulnerability reporting channels, secure update distribution, and advisory messages for users.

The current file must identify every software version that affects compliance, while the history preserves what changed, how each version was identified, and which conformity evidence applied. Update the documentation when product changes, tests, reported vulnerabilities, third-party information, or support-period decisions change the compliance evidence.

Article 31 requires technical documentation and conformity-assessment correspondence in an official language of the Member State where the notified body is established or another language acceptable to that body. A market surveillance authority can separately require the information in a language it can easily understand. Record both language decisions when a notified body and an authority are involved.

Article 32 and Annex VIII determine how the file is used in conformity assessment. Under Module A, the manufacturer draws up the Annex VII technical documentation and declares conformity on its own responsibility. Under Module B+C or Module H, notified-body material such as applications, certificates, evaluation reports, quality-system approvals, surveillance records, and vulnerability-handling audit records should sit beside the same Annex VII evidence. Module H still requires technical documentation for one model of each product category covered by the quality-system application.

Annex VIII requires the EU declaration of conformity and technical documentation to be kept at the disposal of national authorities for 10 years after the product is placed on the market or for the support period, whichever is longer. The Commission FAQ also notes that market surveillance authorities may request the documentation and that it must be comprehensive and clear.

Article 31(3) requires one technical-documentation set for a product covered by CRA Article 12 and other Union acts that also require technical documentation. The combined file must contain both Annex VII material and the information required under the other acts; combining files does not remove either set of requirements.

For other products subject to several Union acts, coordinate the technical file and the single EU declaration of conformity required by Article 28, but verify the document rules in each applicable act. Keep act-specific assessments identifiable so an authority or notified body can see which evidence supports each legal requirement.