The EU declaration of conformity under the CRA
Updated 1 November 2026 · This guide explains the law in plain words. It is not legal advice.
The EU declaration of conformity is the document in which you, the manufacturer, state that your product meets the essential cybersecurity requirements of the Cyber Resilience Act (CRA) in Annex I (Article 28(1)). It follows the model in Annex V, you sign it only after the conformity assessment shows the requirements are met, and by signing it you take responsibility for the product (Article 28(4)). Then you add the CE mark.
When you can sign
The order is fixed by Article 13(12). First you draw up the technical documentation. Then you carry out the conformity assessment, yourselves or through a notified body, depending on your product class. Only when that assessment has shown that the product meets Part I of Annex I, and your processes meet Part II, do you draw up the declaration and add the CE mark.
All of this happens before the product goes on the market. From 11 December 2027, a new product sold in the EU without these steps breaks the rules.
What it must contain
Annex V lists eight items.
| Item | What to write |
|---|---|
| 1 | Name and type of the product, and anything else that identifies it uniquely |
| 2 | Name and address of the manufacturer or its authorised representative |
| 3 | A statement that the declaration is issued under the sole responsibility of the provider |
| 4 | The object of the declaration, identified so it can be traced; a photo may help |
| 5 | A statement that the product conforms to the relevant EU harmonisation legislation |
| 6 | References to any harmonised standards, common specifications or cybersecurity certification used |
| 7 | Where applicable, the notified body's name and number, the procedure it carried out, and the certificate it issued |
| 8 | Additional information, then the signature block: for whom, place and date, name, function and signature |
Item 6 will be thin for most small makers right now. When we checked on 31 October 2026, no harmonised CRA standard had been cited in the Official Journal, so there may be nothing to list, and your technical file describes your own solutions instead.
One declaration for several laws
If your product falls under more than one EU law that requires a declaration of conformity, you draw up a single declaration covering all of them, naming each law with its publication reference (Article 28(3)). A Wi-Fi camera, for example, might need one declaration listing both the CRA and the Radio Equipment Directive.
Language and updates
The declaration must be available in the languages required by each member state where you sell the product (Article 28(2)). You update it as appropriate, for example when a new firmware version changes what the declaration describes.
The simplified declaration
You must provide either a full copy of the declaration with the product, or a simplified one (Article 13(20)). The simplified version, set out in Annex VI, is one sentence naming your company, the product type and Regulation (EU) 2024/2847, followed by the exact internet address where the full declaration can be read. A practical setup: print the simplified one in the quick-start leaflet and host the full one on your website.
The CE mark that goes with it
The CE mark has to be visible, legible and indelible on the product. If that isn't possible, it goes on the packaging and the declaration (Article 30(1)). For software products, it goes on the declaration or on the product's website, in a section consumers can reach easily.
Other rules from Article 30:
- It goes on before the product is placed on the market (Article 30(3)).
- On a small device it may be smaller than 5 mm, as long as it stays legible (Article 30(2)).
- If a notified body carried out an assessment based on full quality assurance (module H), its identification number follows the CE mark (Article 30(4)).
Keeping it
You keep the declaration, with the technical documentation, for at least 10 years after placing the product on the market, or for the support period if that's longer (Article 13(13)). A copy also sits inside the technical file (Annex VII, point 7).
What signing really means
Signing a declaration you can't back up is a bigger risk than signing late. Breaching the rules on the declaration (Article 28) or on the CE mark (Article 30(1) to (4)) can bring fines of up to €10 million or 2% of worldwide annual turnover, whichever is higher (Article 64(3)). Breaching the Annex I requirements themselves falls under the higher tier of up to €15 million or 2.5% (Article 64(2)). The fines guide explains how authorities set the amount.
What Proofsheet does here
The Paperwork pack (€249) includes a declaration checklist. It lists the eight Annex V items and the steps that must come before them, and shows which ones the generated evidence supports and which you still need to complete. The app also maps your file to the 22 Annex I points as evidenced, partial or open, so you can see the gaps before you sign.
No software can sign the declaration, choose your conformity route or put on the CE mark. Only you can. What the app generates is technical evidence, not a legal certificate.
See a sample report, or read the guides on product classes and technical documentation.