Your CRA technical file. Drafted in seconds.

The Commission's own estimate for a manufacturer's self-assessment is €18,400 per product, with the technical documentation, CE marking, declaration and reporting on top at a further 9% of development cost, a survey figure it says it could not verify (SWD(2022) 282, 2022). The technical file is the documented part of that job.

What is in the file

11 controlled documents: the seven Annex VII lists, then the four operating documents Annex I Part II presumes you have. Each is versioned, approved and hash-chained in your organization, and exports as a PDF with the sha256 of the approved text in the footer, so the file you hand an authority in 2029 is provably the file approved in 2026.

The 22 Annex I requirements the file has to show, as one table

The documents are drafted in English, under the titles below. The Regulation fixes no language for the technical file: Article 13(22) requires it in a language the requesting authority can easily understand, which makes translation a task for when an authority asks, not before. The one exception is the user information under Annex II, which has to be in a language your users understand, and the document says so where it applies.

1. 1

   Scope and classification determination · Article 3 and Annex III

2. 2

   General description and user information · Annex VII point 1, Annex II

3. 3

   Cybersecurity risk assessment · Annex VII point 3, Annex I Part I

4. 4

   Vulnerability handling process · Annex VII point 2, Annex I Part II

5. 5

   Support period determination · Annex VII point 4, Article 13(8)

6. 6

   Standards applied and test evidence · Annex VII points 5 and 6

7. 7

   EU declaration of conformity (draft) · Annex VII point 7, Annex V

8. 8

   Coordinated vulnerability disclosure policy · Annex I Part II points 5 and 6

9. 9

   Security updates and support statement · Annex I Part II points 2, 7 and 8, Article 13(8)

10. 10

    Software bill of materials procedure · Annex I Part II point 1

11. 11

    Article 14 reporting procedure · Article 14, Article 71(2)

How it goes

1. 1Create your organization. Free, two minutes, no card. The pack needs somewhere to be delivered: your own StandardOS organization, where the documents version, lock and export.
2. 2Record the product. Name, versions, what it does, how it reaches the market, which Annex III or IV entry you considered, the support period and why. Then the Annex I checklist: every requirement, applicable or not, and how it is met. Ten minutes for a product you know.
3. 3Pay at checkout. By card, through Paddle, who is the merchant of record and handles VAT. €5,000 once, per product.
4. 4The file is drafted. Within seconds of the payment confirming, eleven controlled documents appear in your organization, each already saying everything the record holds and marking what still has to be written. Edit, approve, lock, export as PDF with the hash in the footer, or download the whole file as one bundle.

Default, important or critical: the tier goes on page one

Annex III lists 19 categories of important products in class I and 4 in class II; Annex IV lists 3 critical ones. Everything else in scope is default. The tier decides whether you may assess conformity yourself or need a notified body (Article 32); it does not change the file's contents or the reporting duty. The pack's scope document records which tier and why, quoting the row.

What it is not

• Not security testing. The file indexes the test reports you hold; it does not produce them.
• Not a notified body's assessment. Products in Annex III class II or Annex IV need one; the file is still the documentation the notified body starts from.
• Not legal advice. It is the documentation the Regulation names, drafted from your facts, for you to complete and approve.
• Not a subscription. Keeping the file current afterwards, as versions and components change, with the integrations reading your systems, is what the €249/mo product is for. Your choice.

Article 13 and Annex VII are short enough to read yourself: Regulation (EU) 2024/2847. This page is not legal advice.