The declaration comes after the applicable conformity assessment demonstrates compliance. It is not a replacement for technical documentation or testing. Annex V defines the full declaration. Article 13(20) allows the manufacturer to provide either the full declaration or an Annex VI simplified declaration with the product, but the simplified declaration must provide the exact internet address where the full declaration can be accessed.
The Declaration Comes After Conformity Has Been Demonstrated
Article 13 requires the manufacturer to carry out or have carried out the applicable Article 32 conformity assessment procedure. Where that procedure demonstrates compliance of the product with Annex I Part I and the manufacturer's processes with Annex I Part II, the manufacturer draws up the EU declaration of conformity in accordance with Article 28. The declaration records the conformity conclusion; it does not replace the assessment that supports that conclusion.
- Complete applicable conformity assessment.
- Demonstrate Annex I conformity.
- Then draw up the EU declaration.
- Then proceed to CE marking.
Article 28 Requires an Annex I Compliance Statement
Article 28 requires the EU declaration of conformity to state that fulfilment of the applicable essential cybersecurity requirements in Annex I has been demonstrated. The manufacturer should therefore ensure that the product identified in the declaration is the same product and release supported by the technical documentation and conformity evidence.
- State Annex I conformity.
- Identify the correct product.
- Align with technical documentation.
- Align with the assessed release.
The Full Declaration Uses the Annex V Model Structure
Article 28 requires the EU declaration of conformity to have the model structure set out in Annex V and to contain the elements specified in the relevant Annex VIII conformity assessment procedure. Annex V therefore provides the CRA baseline for the full declaration rather than leaving manufacturers to invent their own declaration content.
- Use Annex V structure.
- Include relevant Annex VIII elements.
- Maintain consistency with the selected conformity route.
Annex V Item 1 Identifies the Product
Annex V requires the name and type of the product with digital elements together with any additional information enabling its unique identification. The declaration should be precise enough to determine which product or product model is covered rather than using a generic family description that creates uncertainty about applicability.
- Product name.
- Product type.
- Additional unique-identification information.
Annex V Item 2 Identifies the Manufacturer
The declaration includes the name and address of the manufacturer or its authorised representative. These details should correspond to the responsible economic operator information used elsewhere in the product and compliance documentation.
- Manufacturer name.
- Manufacturer address.
- Authorised representative details where applicable.
Annex V Includes a Sole-Responsibility Statement
Annex V requires a statement that the EU declaration of conformity is issued under sole responsibility. The Annex V text uses the wording sole responsibility of the provider. Article 28(4) separately establishes the central legal point by stating that, by drawing up the EU declaration of conformity, the manufacturer assumes responsibility for compliance of the product with digital elements.
- Include the Annex V responsibility statement.
- Manufacturer assumes compliance responsibility under Article 28(4).
- Do not treat a notified-body certificate as transferring manufacturer responsibility.
The Object of the Declaration Must Be Traceable
Annex V requires identification of the object of the declaration in a manner allowing traceability and provides that this may include a photograph where appropriate. Product identifiers used here should be compatible with model, version or other traceability information maintained in the technical documentation.
- Identify object of declaration.
- Support traceability.
- Include a photograph where appropriate.
- Align identifiers with compliance evidence.
State Conformity With Relevant Union Harmonisation Legislation
Annex V requires a statement that the object of the declaration is in conformity with the relevant Union harmonisation legislation. Where more than one Union legal act requires an EU declaration of conformity, Article 28 permits a single declaration covering all such acts, provided that the declaration identifies the Union legal acts concerned and includes their publication references.
- Identify applicable Union harmonisation legislation.
- Use one declaration for multiple applicable Union acts where appropriate.
- Include publication references.
List Relevant Standards, Specifications or Certification
Annex V requires references to relevant harmonised standards used or other common specifications or cybersecurity certification in relation to which conformity is declared. These references should match the technical documentation and the actual conformity approach used by the manufacturer. Do not list standards merely because they are related to cybersecurity if they were not part of the conformity basis.
- Harmonised standards.
- Common specifications.
- Cybersecurity certification.
- Use accurate references.
Include Notified-Body Information Where Applicable
Where applicable, Annex V requires the name and number of the notified body, a description of the conformity assessment procedure performed and identification of the certificate issued. A Module A declaration therefore differs from a declaration supported by Module B plus C or Module H because notified-body information is included only where applicable.
- Notified-body name.
- Notified-body number.
- Conformity procedure.
- Certificate identification.
Complete the Signature Information
Annex V concludes with additional information and signature fields covering the person signing for and on behalf of the responsible organisation, the place and date of issue, name, function and signature. The signed declaration should be controlled as a compliance record and associated with the relevant product version.
- Signed for and on behalf of.
- Place of issue.
- Date of issue.
- Name.
- Function.
- Signature.
Update the Declaration as Appropriate
Article 28 states that the EU declaration of conformity shall be updated as appropriate. Product changes, conformity-route changes, standards references, certificates or manufacturer information can make an existing declaration inaccurate. Change management should therefore include a declaration-impact check rather than assuming the document remains valid indefinitely.
- Review after relevant product changes.
- Review conformity-procedure changes.
- Review standards references.
- Review notified-body or certificate information.
- Issue a controlled updated declaration where appropriate.
Use the Languages Required by the Member State
Article 28 requires the declaration to be made available in the languages required by the Member State in which the product is placed on the market or made available on the market. The simplified declaration has the same Member State language principle. Manufacturers distributing across several Member States should therefore manage declaration-language coverage as part of market-entry planning.
- Identify target Member States.
- Check required declaration languages.
- Control translated versions.
- Keep translations aligned with the current declaration.
The Simplified Declaration Is an Annex VI Option
Article 13(20) requires manufacturers to provide either a copy of the EU declaration of conformity or a simplified EU declaration of conformity with the product. Article 28 states that the simplified declaration follows the model structure in Annex VI. The simplified declaration states that the identified product type complies with Regulation (EU) 2024/2847 and points users to the full declaration.
- Full declaration can accompany the product.
- Or use the Annex VI simplified declaration.
- Identify manufacturer.
- Identify product type.
- State CRA compliance.
The Simplified Declaration Must Give the Exact Internet Address
Where the manufacturer supplies the simplified declaration, Article 13(20) requires it to contain the exact internet address at which the full EU declaration of conformity can be accessed. A generic corporate homepage that forces users to search for the declaration would not reflect that exact-address requirement. The linked full declaration should also remain aligned with the product and current conformity record.
- Provide exact internet address.
- Link to the full declaration.
- Avoid generic navigation-only links.
- Maintain link availability.
Retain the Declaration With the Technical Documentation
Article 13 requires manufacturers to keep the technical documentation and EU declaration of conformity at the disposal of market surveillance authorities for at least 10 years after the product has been placed on the market or for the support period, whichever is longer. Declaration storage should therefore support long-term retrieval and product-version traceability.
- At least 10 years after market placement.
- Or the support period where longer.
- Keep declaration available to market surveillance authorities.
- Preserve product-version traceability.
Official sources
Read the full legal text and Commission material for precise wording, qualifications and updates.