What is the EU declaration of conformity under the Cyber Resilience Act?
The declaration of conformity is the shortest document in the stack and the one with the most weight: it is where the manufacturer, in their own name, states that the product satisfies the essential requirements. Its structure comes from Annex V, and a simplified form from Annex VI [1].
What it contains
The Annex V structure names the product, identifies the manufacturer, states the requirements the product conforms to, references the standards or specifications applied, records the conformity assessment procedure used and, where a notified body was involved, identifies it — signed with place, date and signatory [1].
Two practical points hide in that list. The signatory matters: the declaration is made by the manufacturer — the person who develops or manufactures the product or has it developed and markets it under their name — so the identity block must be your real legal identity, not a trading name that exists nowhere [2]. And the assessment procedure line must match reality: a declaration reciting a third-party module nobody performed is worse than none [3].
The simplified declaration
You may provide a simplified EU declaration of conformity that contains the internet address at which the full declaration can be accessed [4]. For software this is the natural pattern: the simplified form travels wherever product information travels, and the full declaration lives at a stable URL you control [4]. The full document still has to exist and stay reachable — the simplified form is a pointer, not a substitute.
Where it lives and for how long
The declaration is kept together with the technical documentation for at least ten years after placing on the market, or for the support period, whichever is longer [5]. The CE marking, for software, may be affixed on the declaration itself or on the accompanying website — the two documents are companions [6].
Treat the retention duty as an ownership question now: pick where the declaration and technical file will live for a decade [5]. A founder's laptop does not meet that bar; a repository plus a stable public URL does.
When you need one
The duty arrives with full application on 11 December 2027 for products placed on the market from that date [7]. Drafting it early is cheap, because the declaration is a summary of decisions you have to make anyway: which requirements apply, which assessment route, which standards. If the summary is hard to write, the underlying work is not done — which is precisely the diagnostic value of drafting it.
Check where you stand
The checker determines your product's route and generates a declaration skeleton in that structure [1] with your product's actual details, with citations.
What to do next
Run your own product through the checker — it takes under a minute and gives you a dated, citable result you can send to a customer.
Sources
- EU declaration of conformity (Annex V) and simplified declaration (Annex VI). Art. 28, Art. 13(12), (20), Annex V, Annex VI — EUR-Lex ↩
- Manufacturer: a natural or legal person who develops or manufactures products with digital elements or has them designed, developed or manufactured, and markets them under their name or trademark, whether for payment, monetisation or free of charge. Art. 3(13) — EUR-Lex ↩
- Conformity routes: default products may use internal control (Module A), EU-type examination plus internal production control (Modules B+C), full quality assurance (Module H) or a European cybersecurity certification scheme; important class I must use B+C or H (or a scheme at 'substantial' level) unless harmonised standards, common specifications or such a scheme are applied in full; important class II must use B+C, H or a scheme at 'substantial' level; critical products use a European scheme where available, otherwise the class II procedures. Art. 32(1)–(4), Annex VIII — EUR-Lex ↩
- A manufacturer may provide a simplified EU declaration of conformity that contains the internet address at which the full declaration can be accessed. Art. 13(20), Art. 28(2), Annex VI — EUR-Lex ↩
- Technical documentation (Annex VII) is drawn up before placing on the market and kept, with the EU declaration of conformity, for at least ten years after placing on the market or the support period, whichever is longer. Art. 13(12)–(13), Art. 31 — EUR-Lex ↩
- CE marking is affixed visibly, legibly and indelibly to the product, or where not possible to the packaging or the declaration of conformity/accompanying documents; for software, on the declaration of conformity or the website accompanying the product. Art. 29–30 — EUR-Lex ↩
- The Regulation applies in full from 11 December 2027. Art. 71(2) — EUR-Lex ↩
Related
- Where does the CE marking go on a software product?
Software gets CE marked on the declaration of conformity or on the website accompanying the product — not in the app. The marking is the last step of a process, not a badge you add.
- What goes in the CRA technical file?
A technical file in the Annex VII structure — product description, design and vulnerability-handling documentation, risk assessment, SBOM, test reports — drawn up before market placement and kept for ten years or the support period.
- How long is the support period under the CRA?
You set the support period yourself, but it has a floor: it must reflect the time the product is expected to be in use, and at least five years unless the product is expected to be used for less.
- Does my product need third-party assessment under the CRA?
Most products, no — default products self-assess under Module A. A notified body enters only for important class I products not applying standards in full, for class II, and for critical products without a certification scheme.
CEMarque encodes Regulation (EU) 2024/2847 and the European Commission's published guidance as of 10 September 2026 (Facts v2026.09.4). It is not legal advice. Verify obligations for your product with qualified counsel where the stakes require it.