EU declaration of conformity

The EU declaration of conformity is the document in which a manufacturer formally declares that its product meets the essential cybersecurity requirements. The Cyber Resilience Act (CRA) governs it in Article 28 and sets out the model form in Annex V. Without it, a product with digital elements may not be placed on the market.

It is not a covering note but an assumption of responsibility: by drawing it up, the manufacturer assumes responsibility for the conformity of the product (Article 28(4)). The signature binds the company, whoever inside it actually ran the testing.

It comes at the end of the evidence chain

Article 13(12) fixes the order. Before placing the product on the market, the manufacturer draws up the Technical documentation and carries out the chosen Conformity assessment procedure under Article 32, or has it carried out. Only once that procedure has demonstrated that the product meets Annex I Part I, and that the manufacturer’s processes meet Annex I Part II, is the declaration drawn up and the CE marking affixed.

The sequence is not a formality. A declaration signed before the assessment is finished declares something nobody has yet demonstrated.

The minimum content in Annex V

Annex V prescribes eight items. Seven of them apply whatever procedure was used:

• name and type, plus anything else needed to identify the product uniquely
• name and address of the manufacturer or its authorised representative
• a statement that the declaration is issued under sole responsibility
• the object of the declaration, identified so that it can be traced (with a photograph where appropriate)
• a statement that this object conforms to the relevant Union harmonisation legislation
• references to the harmonised standards, common specifications or cybersecurity certification relied on
• additional information, plus place and date of issue and the name, function and signature of the signatory

The remaining item applies only where a Notified body was involved: its name and number, a description of the conformity assessment procedure performed and the identification of the certificate issued. Annex V is a floor rather than a ceiling: Article 28(2) adds whatever the applied Annex VIII procedure requires, and the Commission may extend the list by delegated act.

One declaration for all applicable acts

Where a product is subject to Union acts beyond the CRA that also require a declaration of conformity, Article 28(3) calls for a single declaration covering all of them, identifying each act together with its publication reference. The recitals allow that single declaration to take the form of a dossier assembled from the individual declarations, so existing documents remain usable.

Supplying it, publishing it, keeping it

Article 13(20) requires either a copy of the full declaration or a simplified one to be provided with the product. The simplified version follows the short wording in Annex VI and must give the exact internet address at which the full declaration can be accessed. In practice that commits the manufacturer to keeping that page alive.

For products in the form of software, Article 30(1) has the CE marking affixed either to the declaration itself or to the website accompanying the software product; in the latter case the relevant section of the website must be easily and directly accessible to consumers. The declaration can therefore become the carrier of the marking.

It must be kept at the disposal of the Market surveillance authority for at least ten years after placing on the market, or for the support period if that is longer (Article 13(13)). A copy also belongs in the technical documentation under Annex VII, point 7.

Who else has to hold it

Importers keep their own copy for the same period and must be able to produce the technical documentation on request (Article 19(6)). For an authorised representative, keeping the declaration available is among the minimum tasks of the mandate under Article 18(3); Annex VIII goes further and lets the representative draw it up on the manufacturer’s behalf and under its responsibility, where the mandate provides for that. Distributors check before making a product available that the Article 13(20) duty has been met.

A missing declaration is a breach in its own right

Article 58 treats this as formal non-compliance. Where the declaration has not been drawn up, or has not been drawn up correctly, the market surveillance authority requires the manufacturer to put an end to it. If the non-compliance persists, the Member State takes all appropriate measures to restrict or prohibit making the product available on the market, or to ensure that it is recalled or withdrawn from the market.

Note what none of this depends on: whether the product is actually insecure. A technically sound product can be taken off the market over a defective declaration alone.