CRA Declaration of Conformity: Template and Step-by-Step Writing Guide

Every product with digital elements needs an EU Declaration of Conformity before it can legally carry the CE marking. The DoC is your formal statement that the product meets CRA requirements. You are legally responsible for its accuracy.

This guide provides a complete template and explains each required element.

What Is the EU Declaration of Conformity?

The EU Declaration of Conformity is a formal legal document in which the manufacturer declares that a product complies with applicable EU legislation. It is mandatory for all products with digital elements before they can bear the CE marking. For CRA products, it must state:

• The product meets the essential cybersecurity requirements (Annex I)
• Conformity assessment has been completed
• The manufacturer takes legal responsibility

Without a signed DoC, your product cannot bear the CE marking and cannot be legally placed on the EU market.

What Does the CRA Require in the DoC?

Legal Basis

CRA Article 28 specifies DoC requirements, referencing the structure in Annex V. The DoC must be:

• Drawn up before placing the product on the market (Article 13(12))
• Updated as appropriate when the product or compliance status changes (Article 28(2))
• Provided in the language(s) required by each Member State where the product is placed (Article 28(2))
• Retained for at least 10 years after placing on the market, or for the length of the support period, whichever is longer (Article 13(13))

Required Elements

Complete DoC Template

Use this as a starting point. Customize the bracketed sections for your product.

═══════════════════════════════════════════════════════════════
                 EU DECLARATION OF CONFORMITY
                    (Cyber Resilience Act)
═══════════════════════════════════════════════════════════════

Declaration No.: [DoC-PRODUCT-YYYY-NNN]
Date of Issue: [DD Month YYYY]

---------------------------------------------------------------
1. MANUFACTURER
---------------------------------------------------------------

Name:           [Company Legal Name]
Address:        [Street Address]
                [Postal Code, City]
                [Country]
Contact:        [Email / Phone]
Website:        [URL]

---------------------------------------------------------------
2. PRODUCT IDENTIFICATION
---------------------------------------------------------------

Product Name:   [Product Name]
Model/Type:     [Model Number / Type Designation]
Hardware Ver:   [Hardware Version, if applicable]
Software Ver:   [Software/Firmware Version]
Batch/Serial:   [Batch number range or serial number format]
Product Photo:  [Optional photograph for traceability, where appropriate]

Product Description:
[Brief description of the product and its intended purpose,
sufficient to identify the product unambiguously]

---------------------------------------------------------------
3. DECLARATION
---------------------------------------------------------------

This declaration of conformity is issued under the sole
responsibility of the provider.

The object of the declaration described above is in conformity
with the relevant Union harmonisation legislation:

    • Regulation (EU) 2024/2847 of the European Parliament
      and of the Council of 23 October 2024 on horizontal
      cybersecurity requirements for products with digital
      elements (Cyber Resilience Act)

    [• Additional applicable legislation, e.g.:
    • Directive 2014/53/EU (Radio Equipment Directive)
    • Regulation (EU) 2023/1230 (Machinery Regulation)
    • etc.]

---------------------------------------------------------------
4. CONFORMITY ASSESSMENT
---------------------------------------------------------------

Conformity assessment procedure applied:

    [Choose one:]

    ☐ Module A (Internal Production Control)
      Based on Annex VIII of Regulation (EU) 2024/2847

    ☐ Module B + C (EU-Type Examination + Conformity to Type)
      Based on Annex VIII of Regulation (EU) 2024/2847
      Notified Body: [Name], No. [XXXX]
      EU-Type Examination Certificate: [Certificate Number]
      Date: [Certificate Date]

    ☐ Module H (Full Quality Assurance)
      Based on Annex VIII of Regulation (EU) 2024/2847
      Notified Body: [Name], No. [XXXX]
      QA System Certificate: [Certificate Number]
      Date: [Certificate Date]

    ☐ European Cybersecurity Certification Scheme (Article 27(9))
      Certificate issued under a scheme adopted pursuant to
      Regulation (EU) 2019/881 (Cybersecurity Act)
      Certification scheme: [Name]
      Certificate number: [Number]
      Assurance level: [Substantial / High]

---------------------------------------------------------------
5. STANDARDS AND SPECIFICATIONS APPLIED
---------------------------------------------------------------

Harmonised standards applied:
[List all harmonised standards used, with full references]

    • EN [XXXXX]:20XX - [Standard Title]
    • EN [XXXXX]:20XX - [Standard Title]

Other technical specifications applied:
[List any other standards or specifications used]

    • ISO/IEC [XXXXX]:20XX - [Standard Title]
    • [Other specifications]

Cybersecurity certifications applied (if applicable):
[List any European cybersecurity certificates per Annex V item 6]

    • [Certification scheme name - Certificate reference]

---------------------------------------------------------------
6. ADDITIONAL INFORMATION (CRA-Specific)
---------------------------------------------------------------

Support Period:
Security updates will be provided until: [DD Month YYYY]
(Minimum 5 years from date of market placement)

First EU Market Placement: [DD Month YYYY]

Cybersecurity Contact:
For vulnerability reports and security inquiries:
    Email: [security@company.com]
    Web:   [https://company.com/security]
    security.txt: [https://company.com/.well-known/security.txt]

Technical Documentation:
Technical documentation is available upon request to
competent authorities at the address above.

---------------------------------------------------------------
7. SIGNATURE
---------------------------------------------------------------

Signed for and on behalf of:

[Company Legal Name]


_________________________________
[Full Name]
[Title/Function]

Place: [City, Country]
Date:  [DD Month YYYY]

═══════════════════════════════════════════════════════════════
                         END OF DECLARATION
═══════════════════════════════════════════════════════════════

Section-by-Section Guidance

1. Document Identification

Declaration Number: Not required by Annex V but strongly recommended as best practice for version control and internal tracking. Recommended format:

• DoC-[ProductCode]-[Year]-[Sequence]
• Example: DoC-SSP3000-2027-001

Date of Issue: The date you sign the declaration. Must be after conformity assessment is complete.

2. Manufacturer Identification

Who signs the DoC?

• The manufacturer: the entity that designed, produced, or markets the product under its own name
• OR an authorized representative established in the EU, acting under a written mandate

If the manufacturer has no establishment in the EU, appointing an authorized representative is required. Add:

Authorized Representative: [Name, Address]
acting on behalf of: [Manufacturer Name, Address]

3. Product Identification

Be specific enough for traceability:

• Include model numbers, not just product names
• Specify version numbers for hardware and software separately
• Indicate batch or serial number scope

Example:

Product Name:   SmartSense Pro Industrial Sensor
Model/Type:     SSP-3000
Hardware Ver:   Rev C (PCB v3.2)
Software Ver:   Firmware 2.4.1
Batch/Serial:   Serial numbers SSP3K-2027-XXXXXX

4. Conformity Assessment

Which module you must use depends on your product's classification. Use this table to orient yourself:

Use this flowchart to identify your path:

flowchart TD
    A["What is your product class?"] --> B["Default\n(not Annex III/IV)"]
    A --> C["Class I\n(Annex III)"]
    A --> D["Class II\n(Annex III)"]
    A --> E["Critical\n(Annex IV)"]
    B --> F["Module A, B+C, or H\nyour choice"]
    C --> G{"Harmonized standards\nfully applied?"}
    G -->|Yes| H["Module A available\nor B+C / H"]
    G -->|No| I["Module B+C or H\nNotified Body required"]
    D --> J["Module B+C or H\nNotified Body required"]
    E --> K["EU-type examination\nspecialised Notified Body"]

5. Standards Applied

Harmonized Standards:

• Standards published in the Official Journal of the EU
• Create a presumption of conformity for the requirements they cover
• Include full reference: number, year, title

Format:

EN 303 645:2020 - Cyber Security for Consumer Internet of Things: Baseline Requirements

If no harmonized standards exist: State: "No harmonised standards applied. Conformity demonstrated through [describe approach]."

Cybersecurity Certifications (Annex V, item 6): If a European cybersecurity certificate was relied on during conformity assessment, list it here with the scheme name and certificate reference number.

6. CRA-Specific Additional Information

This section is not required by Annex V, but including it improves regulatory transparency:

Support Period: State when security updates end. Must be at least 5 years from market placement (Article 13(8)).

Cybersecurity Contact: Where vulnerability reports should be sent, including a reference to your security.txt file.

7. Signature

Who can sign:

• A person authorized to legally commit the manufacturer
• Typically: CEO, Director, Quality Manager, or Regulatory Affairs Lead

Requirements:

• Full name and title/function
• Place and date (date must be after assessment completion)
• Handwritten signature, or a qualified electronic signature

When Must CE Marking Be Applied Relative to the Declaration of Conformity?

For physical products, affix the CE marking visibly, legibly, and indelibly to the product before placing it on the market (Article 30(1)).

For software-only products (Article 30(3)), the CE marking is placed either:

• Directly on the EU Declaration of Conformity, or
• On the product's website, in a section that is easily and directly accessible to users

Does the DoC Need to Be Translated?

Yes. Article 28(2) requires that the DoC be made available in the language(s) required by each Member State in which the product is placed on the market.

In practice:

• Selling only in Germany → a German DoC is required
• Selling across the EU → you will need multiple language versions
• Keep all language versions in the technical file

The simplified EU DoC (Annex VI) and the URL pointing to the full DoC must also be in the required language(s). The URL itself must remain stable and accessible.

Does Each Product Model or Version Need Its Own Declaration of Conformity?

One DoC Per Product Type

Each distinct product model or type generally needs its own DoC.

Can be covered by a single DoC when:

• Products are variants of the same type
• The same conformity assessment applies to all variants
• The same standards were applied

Example:

Product Name:   SmartSense Pro Industrial Sensor
Model/Type:     SSP-3000 (all variants)
                - SSP-3000-WiFi
                - SSP-3000-LoRa
                - SSP-3000-Cellular

When Does a Modification Require a New DoC?

For the manufacturer's own iterative software releases: if the update is not a substantial modification, the existing DoC remains valid. You must be able to demonstrate this to market surveillance authorities. Performing a cybersecurity risk assessment per Article 13(2) is the explicit mechanism the guidance recommends for this.

DoC Distribution

With the product (Article 13(20)): Article 13(20) requires you to provide either:

• The full Annex V DoC, or
• A simplified EU DoC containing the exact internet address where the full DoC can be found

You are not required to include both.

On request:

• Must be provided to market surveillance authorities
• Should be provided to customers upon request

Simplified EU Declaration of Conformity

Article 13(20) allows manufacturers to ship a simplified EU Declaration of Conformity with the product in place of the full Annex V document. The simplified form is defined in Annex VI and consists of exactly two sentences:

Hereby, [name of manufacturer] declares that the product with digital elements
type [designation] is in compliance with Regulation (EU) 2024/2847.

The full text of the EU declaration of conformity is available at the
following internet address: [URL]

This is particularly useful for:

• Software products where including a full legal document with each distribution is impractical
• Hardware products with limited packaging space
• Any product where the full DoC is published online

Requirements:

• The full Annex V DoC must exist and be publicly accessible at the stated URL
• The simplified declaration must include the URL (Article 13(20))
• The full DoC remains mandatory in the technical file and for authority requests

Best practices for the URL:

• Use a stable URL. Do not change it after products are distributed
• Accessible without registration or login
• The page should allow the DoC to be downloaded or printed

Common Mistakes

DoC Preparation Checklist

Before Drafting

Document Content

Signature

Distribution

DoC Template Variations

For Module A (Self-Assessment)

4. CONFORMITY ASSESSMENT

Conformity assessment procedure applied:

    ☑ Module A (Internal Production Control)
      Based on Annex VIII of Regulation (EU) 2024/2847

      The manufacturer has verified that the product meets
      the essential requirements through internal assessment
      documented in the technical file.

For Module B+C (Third-Party)

4. CONFORMITY ASSESSMENT

Conformity assessment procedure applied:

    ☑ Module B + C (EU-Type Examination + Conformity to Type)
      Based on Annex VIII of Regulation (EU) 2024/2847

      EU-Type Examination performed by:
      Notified Body: TÜV Rheinland LGA Products GmbH
      Notified Body Number: 0197
      Certificate Number: EU-TYPE-2027-12345
      Certificate Date: 15 January 2027

      The manufacturer ensures production conformity to the
      certified type (Module C) through internal production
      controls.

For Multiple Regulations (Article 28(3))

When a product is subject to both the CRA and other EU legislation, a single combined DoC is permitted under Article 28(3):

3. DECLARATION

The object of the declaration described above is in conformity
with the relevant Union harmonisation legislation:

    • Regulation (EU) 2024/2847 (Cyber Resilience Act)

    • Directive 2014/53/EU (Radio Equipment Directive)
      Notified Body: [Name], No. [XXXX]
      Certificate: [Number]

    • Directive 2014/35/EU (Low Voltage Directive)

Retention Requirements

Next Steps

1. Classify the product (Default, Important Class I/II, or Critical) using the CRA Product Classification Guide.
2. Confirm the conformity assessment module with the CRA Conformity Assessment Decision Guide.
3. Complete the conformity assessment and collect all test reports before drafting the DoC.
4. Draft the DoC from the template above. Assign a declaration number and verify every Annex V element.
5. Translate the DoC into the language(s) required by each Member State of placement (Article 28(2)).
6. Sign and date after assessment is complete. Apply the CE marking before market placement.
7. File the signed DoC in the technical file alongside test reports and the SBOM. See CRA Technical File (Annex VII): Complete Guide.
8. Publish the full DoC at a stable URL if you plan to ship the simplified Annex VI form with the product.
9. Retain the DoC for 10 years after market placement, or for the length of the support period, whichever is longer (Article 13(13)).

This article is for informational purposes only and does not constitute legal advice. For specific compliance guidance, consult with qualified legal counsel.