What must a CRA Annex VII technical file contain?

Annex VII of Regulation (EU) 2024/2847 requires a general description of the product and its intended purpose; the design, development and production documentation, including the architecture and the SBOM; the cybersecurity risk assessment under Article 13; the applicable essential requirements from Annex I and how each is met, with the harmonised standards or other specifications applied; the vulnerability-handling process documentation; the reports of the tests performed; and the EU Declaration of Conformity.

Is an SBOM required under the EU CRA?

Yes. The manufacturer must identify and document the components in the product, including through a software bill of materials in a commonly used machine-readable format covering at least the top-level dependencies, and keep it as part of the technical documentation.

How long must CRA technical documentation be kept?

The technical documentation and the EU Declaration of Conformity must be kept at the disposal of the market surveillance authorities for at least ten years after the product is placed on the market, or for the support period, whichever is longer.

ChecklistAnnex VIIRegulation (EU) 2024/2847

The Annex VII technical file

Eight evidence areas your CRA technical documentation must contain — drawn up before the product reaches the market.

The CRA defines the required technical documentation in Annex VII. A manufacturer must draw it up before placing the product on the market, keep it current through the support period, and make it available to market-surveillance authorities on request. Here is what a complete file contains.

Product description

Annex VII §1

A general description of the product with digital elements: its intended purpose, versions, and the software and hardware it comprises — including photographs or illustrations where they aid understanding.

Design, development & production

Annex VII §2

A description of the design and development process, including how the essential requirements were applied, and of the production and monitoring processes. For OT teams, this is where an IEC 62443-4-1 lifecycle supplies much of the evidence.

Vulnerability-handling process

Annex VII §3

A description of the vulnerability-handling process required by Annex I, Part II — including the coordinated-disclosure policy, the security contact, and how updates are delivered across the support period.

Cybersecurity risk assessment

Annex VII §4

The Article 13 risk assessment. It must be carried out before market placement, inform every phase of development, and be updated through the support period as vulnerabilities and the threat context change.

Support-period rationale

Annex VII

Where relevant, the manufacturer's determination of the support period, with the reasoning behind it. A CRA-native artefact — no generic policy substitutes for a product-specific justification.

Applied standards (or alternative solutions)

Annex VII §5

A list of the harmonised standards applied. Where a standard was not applied, a description of the solutions adopted to meet the essential requirements instead — the evidence chain behind any "presumption of conformity" claim.

Test reports & SBOM

Annex VII §5

Reports of the tests carried out to verify conformity with the essential requirements, plus the Software Bill of Materials covering the top-level dependencies of the product. The SBOM is mandatory for any product containing software.

EU Declaration of Conformity

Annex VII §6 · Annex V

A copy of the EU Declaration of Conformity, in which the manufacturer takes sole responsibility for the product's compliance. It underpins the CE mark and is the legal keystone of the file.

Retention: the technical documentation and the EU Declaration of Conformity must remain available to market-surveillance authorities for at least 10 years after the product is placed on the market, or for the support period — whichever is longer. Not sure which conformity route applies to your product? Run the CRA classifier.

Source: Regulation (EU) 2024/2847 — Annex VII (technical documentation); Annex V (EU Declaration of Conformity); Article 13 (risk assessment, support period); Annex I (essential requirements, including SBOM).

Assemble the file without assembling it by hand.

The CRA Workbench builds each of these eight areas from a structured product profile, scores the evidence the way an auditor will, and outputs a reviewer-ready Annex VII package.

See the CRA Workbench →

This checklist is general information about Regulation (EU) 2024/2847, not legal advice. Annex references reflect the published regulation; confirm against the current official text before relying on any point. The CRA Workbench is software that produces draft documentation for expert review; it indicates the evidence needed and does not, by itself, guarantee compliance.