What technical documentation does the Cyber Resilience Act require?
The technical documentation is the file that proves your product meets the essential requirements. Its contents come from Annex VII, and it is drawn up before the product is placed on the market — not assembled afterwards when someone asks [1] [2].
What Annex VII asks for
The structure covers: a general description of the product including its intended purpose; the design, development and production documentation; an assessment of the cybersecurity risks; the vulnerability-handling documentation, including the software bill of materials and the coordinated disclosure setup; the standards or specifications applied; reports of the tests carried out; and a copy of the EU declaration of conformity [1] [3].
Two of those items reach into your engineering practice rather than your writing. The SBOM must exist in a commonly used machine-readable format, covering at least the top-level dependencies — it is generated from your lockfiles, not authored [4]. And the vulnerability-handling documentation describes the processes of Annex I Part II — how reports reach you, how fixes ship, how disclosures are published — which means those processes must exist to be described [5].
The file is private; the instructions are not
Keep the two document sets distinct. The technical file is held for authorities and is not published [2]. The user information and instructions of Annex II — your identity and contact point, the vulnerability reporting contact, the product's intended purpose and security posture, the support period end date — accompany the product and face the user [6]. Pages of this site conflating "documentation" into one pile are how vendors end up publishing internal risk assessments or, worse, shipping products with no user-facing security information at all.
Retention
The file is kept, together with the declaration of conformity, for at least ten years after placing on the market or for the support period, whichever is longer [2]. Version it: the file describes the product as placed on the market, and a substantially modified product needs its documentation brought up to match. A git repository whose tags line up with releases satisfies this naturally.
When, and how much work it is
The duty arrives with full application on 11 December 2027 [7]. For a typical small software product, most Annex VII items are short once the underlying decisions exist: the description and intended purpose are a page, the risk assessment is the structured output of questions you can answer, the SBOM is generated, and the test reports are your existing CI evidence organised [1] [4]. The expensive version of this file is the one started at the last minute before that date [7].
Check where you stand
The checker tells you which requirements apply to your product and generates the technical file skeleton in that structure [1], each section cited.
What to do next
Run your own product through the checker — it takes under a minute and gives you a dated, citable result you can send to a customer.
Sources
- Technical documentation contents (Annex VII). Annex VII, Art. 31 — EUR-Lex ↩
- Technical documentation (Annex VII) is drawn up before placing on the market and kept, with the EU declaration of conformity, for at least ten years after placing on the market or the support period, whichever is longer. Art. 13(12)–(13), Art. 31 — EUR-Lex ↩
- EU declaration of conformity (Annex V) and simplified declaration (Annex VI). Art. 28, Art. 13(12), (20), Annex V, Annex VI — EUR-Lex ↩
- Manufacturers identify and document vulnerabilities and components, including by drawing up a software bill of materials in a commonly used machine-readable format covering at the very least the top-level dependencies. Annex I Part II(1), Art. 13(8), (24) — EUR-Lex ↩
- Annex I Part II — vulnerability handling requirements (checklist items II.1–II.8). Annex I Part II — EUR-Lex ↩
- User information and instructions (Annex II): manufacturer identity and contact; single point of contact for vulnerability reporting; product identification; intended purpose and security environment; circumstances that may lead to significant cybersecurity risks; where fixed-vulnerability information is published; support period end date; update installation and opt-out; secure decommissioning; access to the SBOM where relevant. Annex II, Art. 13(18) — EUR-Lex ↩
- The Regulation applies in full from 11 December 2027. Art. 71(2) — EUR-Lex ↩
Related
- Does the CRA require a coordinated vulnerability disclosure policy?
Yes. Every manufacturer must have a coordinated vulnerability disclosure policy in place, a contact address for reports, a single point of contact for users, and a practice of publishing fixed vulnerabilities.
- Do I need a software bill of materials under the CRA?
Yes. Drawing up a software bill of materials in a commonly used, machine-readable format, covering at least the top-level dependencies, is part of the vulnerability-handling requirements every manufacturer must meet.
- What goes in a CRA declaration of conformity?
A one-document statement, in the Annex V structure, in which the manufacturer takes sole responsibility that the product meets the essential requirements. A simplified web-linked form exists, and it travels with the product's paperwork for a decade or more.
- What must I do by 11 December 2027?
Everything else. From full application a product placed on the EU market needs a completed technical file, an EU declaration of conformity you sign, CE marking, a stated support period and a software bill of materials.
CEMarque encodes Regulation (EU) 2024/2847 and the European Commission's published guidance as of 10 September 2026 (Facts v2026.09.4). It is not legal advice. Verify obligations for your product with qualified counsel where the stakes require it.