The EU declaration of conformity is the shortest document in the Cyber Resilience Act's paperwork and the one with the most weight on it. Article 28(1) of Regulation (EU) 2024/2847 says what it is: the declaration "shall be drawn up by manufacturers in accordance with Article 13(12) and state that the fulfilment of the applicable essential cybersecurity requirements set out in Annex I has been demonstrated". Article 28(4) says what signing it means: "By drawing up the EU declaration of conformity, the manufacturer shall assume responsibility for the compliance of the product with digital elements." The technical file shows the work; the declaration is the manufacturer's signature under it. This article is what the declaration must contain, read from Annex V, the rules around it, and a worked example.
Where it sits in the sequence
Article 13(12) fixes the order. Before placing a product on the market the manufacturer draws up the technical documentation of Article 31, carries out the conformity assessment procedure of Article 32 or has it carried out, and, where that procedure has demonstrated compliance with Part I of Annex I for the product and Part II for the manufacturer's processes, draws up the EU declaration of conformity under Article 28 and affixes the CE marking under Article 30. The Commission's FAQ, section 6.8, puts the consequence plainly: the declaration "cannot be signed if the manufacturer has not performed one of the relevant conformity assessment procedures, with a positive result". What module A, the procedure most software manufacturers will use, actually requires is its own article; the declaration is its last step.
Two documents can carry the declaration to the user. Article 13(20): manufacturers "shall either provide a copy of the EU declaration of conformity or a simplified EU declaration of conformity with the product", and a simplified one "shall contain the exact internet address at which the full EU declaration of conformity can be accessed". The full declaration follows the model structure of Annex V; the simplified one is the single sentence of Annex VI. Both are made available in the languages required by the member state where the product is placed or made available on the market (Article 28(2)).
Annex V, the eight points
Annex V says the declaration "shall contain all of the following information", and lists eight points. The table gives each point, and what a software manufacturer writes against it.
| Point | What Annex V asks for | What to write |
|---|---|---|
| 1 | Name and type and any additional information enabling the unique identification of the product | The product name, the type or model designation, and the version or version range the declaration covers. The FAQ says the declaration is "linked to the individual product and not only to the type or model", but that a unique identifier per unit is not needed. |
| 2 | Name and address of the manufacturer or its authorised representative | The legal entity that places the product on the market, with its postal address, matching Article 13(16) and Annex II point 1. |
| 3 | A statement that the declaration is issued under the sole responsibility of the provider | The Regulation's own word here is "provider", in every language of the Official Journal; the CRA otherwise knows only manufacturers, and Article 28(4) places the responsibility on the manufacturer. The statement names the manufacturer. |
| 4 | Object of the declaration: identification of the product allowing traceability, which may include a photograph where appropriate | For software, the same identification as point 1 plus what traces it: a build identifier, a hash of the release artefact, or the download location and version string. |
| 5 | A statement that the object described above is in conformity with the relevant Union harmonisation legislation | The Regulation, cited with its publication reference. Where other Union acts also require a declaration for the product, all of them (Article 28(3)). |
| 6 | References to any relevant harmonised standards used or any other common specification or cybersecurity certification in relation to which conformity is declared | On 12 September 2026 there is no harmonised standard cited under the Regulation and no common specification, so a default-tier manufacturer writes that conformity was assessed under module A against Annex I directly, and names the technical specifications it applied. |
| 7 | Where applicable, the name and number of the notified body, a description of the conformity assessment procedure performed and identification of the certificate issued | Only where a notified body was involved: modules B and C or module H. For module A, the procedure is named and the rest is not applicable. |
| 8 | Additional information; signed for and on behalf of, place and date of issue, name, function, signature | The person who signs binds the manufacturer under Article 28(4); the date is before the placing on the market. |
Point 3 deserves the aside. "Provider" is the word of Annex V of the AI Act, Regulation (EU) 2024/1689, where the economic operator is the provider and whose point 3 reads the same, and it stands in the CRA in every language of the Official Journal. Nothing turns on it: the declaration is the manufacturer's, and the FAQ's own description is that the manufacturer "declares that the product is compliant with the CRA, and assumes responsibility for that".
The rules around it
Languages. Article 28(2): both forms are made available in the languages required by the member state in which the product is placed or made available on the market. A product sold across the Union may need the declaration in more than one language; the technical file does not (Article 13(22) asks for a language the requesting authority can easily understand).
One declaration for all Union acts. Article 28(3): where a product is subject to more than one Union act requiring an EU declaration of conformity, "a single EU declaration of conformity shall be drawn up in respect of all such Union legal acts", identifying each act with its publication reference. The FAQ adds, from the Blue Guide, that the single declaration "may be a dossier made up of relevant individual Declarations of conformity". A connected device under the Radio Equipment Directive and the CRA has one declaration, or one dossier.
Product families. The Commission's guidance C(2026) 5252, paragraphs 174 and 175: variants, models or configurations that share the same architecture, security-relevant design and intended purpose, and are exposed to the same risks, may rely on a single risk assessment, a single technical file and a single conformity assessment, which "allows a single EU declaration of conformity to be issued for the group of products with digital elements, as long as it clearly identifies the product variants to which it applies".
Versions. Article 28(2) says the declaration "shall be updated as appropriate". The FAQ: "a new version of the product might need a new declaration of conformity, especially when it implements a substantial modification", which is the point at which a product already on the market comes under the Regulation.
Retention. Article 13(13): the technical documentation and the declaration are kept at the disposal of the market surveillance authorities for at least 10 years after the product is placed on the market, or for the support period, whichever is longer. Module A point 4.2 repeats it, and adds that a copy "shall be made available to the relevant authorities upon request". An authorised representative's mandate must let it keep both for the same period (Article 18(3)).
The CE marking. For software, Article 30(1) lets the mark go on the declaration itself or on the website accompanying the product; the CE-marking article has the detail. Annex II point 6 asks the user information to give, where applicable, the internet address at which the declaration can be accessed, which is the address the simplified form points to.
Down the chain. Importers must ensure, before placing the product on the market, that it is accompanied by the declaration referred to in Article 13(20) (Article 19(2)); distributors verify that the manufacturer and importer have complied with Article 13(20) among others (Article 20(2)). A missing declaration stops the product at the first reseller who reads the Regulation.
A worked example
Our example, for a fictional manufacturer, in the order of Annex V. It is a model of the structure, not a form to copy without reading the points above.
- Product: Ledger Desktop, type LD-4, versions 4.2.0 and later within the 4.x series, for Windows and macOS.
- Manufacturer: Example Software GmbH, Musterstraße 1, 10115 Berlin, Germany.
- This EU declaration of conformity is issued under the sole responsibility of the manufacturer.
- Object of the declaration: Ledger Desktop LD-4, version 4.2.0, release artefacts identified by the SHA-256 hashes published at example.com/ledger/releases.
- The object of the declaration described above is in conformity with Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 (Cyber Resilience Act), OJ L, 2024/2847, 20.11.2024.
- Harmonised standards, common specifications or certifications: none cited under the Regulation at the date of issue. Conformity assessed under the internal control procedure (module A) of Annex VIII against the essential requirements of Annex I, applying the technical specifications listed in the technical documentation, section 5.
- Notified body: not applicable.
- Signed for and on behalf of Example Software GmbH, Berlin, 1 December 2027, Jane Doe, Managing Director.
And the simplified form, the sentence Annex VI prescribes, with the blanks filled: "Hereby, Example Software GmbH declares that the product with digital elements type Ledger Desktop LD-4 is in compliance with Regulation (EU) 2024/2847. The full text of the EU declaration of conformity is available at the following internet address: example.com/ledger/conformity."
What a missing or wrong one costs
Article 58(1) lists the findings on which a market surveillance authority "shall require the relevant manufacturer to put an end to the non-compliance concerned"; two of the six are that "the EU declaration of conformity has not been drawn up" and that it "has not been drawn up correctly". Where the non-compliance persists, the member state restricts or prohibits the product's availability on the market, or has it withdrawn or recalled (Article 58(2)). Article 64(3) puts Article 28 in the second tier of fines: up to EUR 10 000 000 or 2 % of total worldwide annual turnover, whichever is higher. An incorrect declaration is also the first thing an authority reads: it names the product, the manufacturer, the procedure and the standards, and each of those is checkable against the file.
The declaration is the seventh of the eleven documents of the technical file pack, drafted from the product record with the eight points in Annex V order, so that what is signed on the day is what the file says. What the file itself contains is the companion piece.
Sources
- Regulation (EU) 2024/2847 (CRA), Article 13(12), (13), (16), (20) and (22), Article 18(3), Article 19(2), Article 20(2), Article 28, Article 30(1), Article 58, Article 64(3), Annex II point 6, Annex V, Annex VI, Annex VIII Part I point 4.2.
- European Commission, FAQs on the Cyber Resilience Act, version 1.4 of 4 September 2026, section 6.8.
- European Commission, guidance C(2026) 5252 of 27 July 2026, paragraphs 174 and 175.
- Regulation (EU) 2024/1689 (AI Act), Annex V, for the origin of the wording of point 3.
This is not legal advice. The declaration binds the manufacturer that signs it; the text to read before signing is the Regulation's.