Technical documentation and conformity assessment
This is the longest strand of CRA work, and the one you cannot catch up on at the end of a project: the technical documentation is the evidence, and the conformity assessment is the procedure that validates it.
The technical documentation (Annex VII)
Drawn up pursuant to Article 31, the technical documentation must demonstrate that the product meets the essential requirements of Annex I. It is compiled before the product is placed on the market and kept up to date throughout the support period.
It covers in particular:
- The product: general description, intended use, versions, operating environment.
- The cybersecurity risk assessment carried out for that product.
- Design and architecture: how the essential requirements are met.
- The product's software components — this is where the software bill of materials belongs.
- The vulnerability handling process and the coordinated disclosure policy.
- The support period chosen and how security updates are distributed.
- Test results and, where applicable, the harmonised standards applied.
Annex VII prevails as to the required content; this list gives its reading structure.
Conformity assessment procedures (Art. 32)
| Procedure | What it is | When it applies |
|---|---|---|
| Module A — internal control | The manufacturer verifies and attests conformity itself, with no third party involved. | Default category; class I where the applicable harmonised standards are applied in full. |
| Modules B + C — EU type-examination, then conformity to type | A notified body examines a representative specimen of the product; the manufacturer then ensures production conforms to the examined type. | Class I without harmonised standards, class II, critical products of Annex IV. |
| Module H — full quality assurance | A notified body assesses the manufacturer's quality system, from design through to final product inspection. | An alternative to modules B + C for the same cases. |
Whichever procedure applies, the object of the assessment does not change: the essential requirements of Annex I.
Can I self-assess?
Yes in two situations: if your product falls into the default category, or if it falls into class I and you apply the applicable harmonised standards in full. In every other case — class I without harmonised standards, class II, Annex IV — a notified body must be involved.
CE marking and EU declaration of conformity
Once the procedure has been carried out, the manufacturer draws up the EU declaration of conformity and affixes the CE marking. Both are only worth what the technical documentation behind them is worth: the marking is not an administrative step at the end of the road, it is the manufacturer's commitment to everything that precedes it.
A working order of operations
- Determine the product's class — it decides the procedure, and therefore the timeline and the budget.
- Carry out the risk assessment: it is what justifies the design choices.
- Build the component inventory and the vulnerability monitoring around it.
- Write the technical documentation as you go, not afterwards.
- Run the applicable assessment procedure, then draw up the EU declaration and affix the CE marking.
Frequently asked questions
When must the technical documentation be ready?
Before the product is placed on the market. It is then kept up to date throughout the support period.
Who can ask me for the technical documentation?
Market surveillance authorities. The importer and the distributor must make sure it has been drawn up and that the CE marking is affixed, without having to compile it themselves.
Do the harmonised standards already exist?
The harmonised standards intended to confer presumption of conformity with the CRA are being developed at European level. Their availability governs whether a class I product can be self-assessed under module A.
Does a notified body approve my product?
It assesses conformity under the chosen procedure — examination of a representative type (modules B + C) or of the quality system (module H). It does not take the manufacturer's place: the manufacturer remains responsible for the product's conformity.
Source: Regulation (EU) 2024/2847, Articles 31 and 32, Annexes I and VII.