What the EU declaration of conformity proves under the Cyber Resilience Act
Under Article 28, drawing up the EU declaration of conformity makes the manufacturer responsible for compliance with the Cyber Resilience Act, and the CE marking is the visible sign of that declaration on the product or on the software's accompanying website. Signing the declaration is therefore a legal statement that the applicable Annex I requirements are met, not an administrative step to close at the end of a project. The declaration must follow the Annex V model, be kept up to date as appropriate, and be available in the languages required where the product is sold. Before signing, the compliance lead should confirm which version of the product and which support period the declaration covers, because a declaration that describes a different release from the one shipped is simply wrong. The consequences of getting this wrong are concrete. Under Article 58(1), a missing or wrongly affixed CE marking, a missing or incorrect EU declaration of conformity, a missing notified body number and missing or incomplete technical documentation are treated as formal non-compliance, and authorities must require the manufacturer to end it. Where the product goes through full quality assurance under module H, the CE marking must also be followed by the identification number of the notified body (Article 30(4)). Each of these items is easy to check in isolation, yet the compliance lead should run them as a single pre-release gate, with the product owner confirming the marking and the number on the actual artifact rather than in a template. The difficulty is that the declaration summarizes work done elsewhere. Its claim that Annex I is met depends on the cybersecurity risk assessment, the technical file under Article 31, the conformity assessment route chosen under Article 32, and any standards applied. A gap in any of those upstream records tends to surface only when someone tries to write the declaration, and by then the release date is close. Compliance leads should ask engineering and the PSIRT team to confirm, in writing, that each referenced document exists, names the same product version and is current before the declaration is finalized.
Full, simplified or combined declaration: which one applies
This is the default route. Where a product with digital elements is subject only to the CRA and no other Union act requires its own EU declaration of conformity, the manufacturer drawing up the declaration must follow the Annex V model. The declaration states that the applicable Annex I requirements are met, and by drawing it up the manufacturer takes responsibility for compliance. It must be available in the languages required in each market where the product is sold.
- Trigger: one applicable Union act, the CRA, and a product that needs no other EU declaration.
- Content: the Annex V model, with the identification of the product, the applicable Annex I requirements and the conformity route used.
- Behind the scenes: the technical documentation under Article 31 must support every statement in the declaration, and the declaration must be updated as appropriate.
- Languages: confirm with each market's requirements which languages the declaration must be supplied in.
- Common mistake: a declaration that cites a conformity route or Annex I requirement set that does not match the technical file behind it. Check the assessment route under Article 32 before signing.
Before signing, confirm that the declaration and the technical file describe the same product version and the same support period.
Article 13(20) allows the manufacturer to supply a simplified EU declaration of conformity in the Annex VI form instead of the full text. The simplified version must give the exact internet address where the full Annex V declaration can be accessed. It is a convenience for the product, not a reduction of the obligation, so the full declaration must exist and remain reachable for the whole period the product is on the market.
- Trigger: the manufacturer chooses to ship the simplified form with the product or in its documentation.
- Address: the URL must point directly to the full Annex V declaration, not a homepage or a support portal.
- Behind the scenes: the full declaration, version history and the technical documentation must be kept current and retrievable.
- Monitoring: test the link after every site migration, domain change or release, and record who owns the hosting.
- Common mistake: a simplified declaration pointing to an address that does not resolve, redirects to a login page or shows an older version than the product in market. Confirm the link resolves to the correct version from outside your corporate network.
Ask the team that publishes the declaration how the address is archived when the product is retired.
Article 28(3) applies when a product is subject to more than one Union act that requires an EU declaration of conformity. In that case the manufacturer issues a single declaration covering all of them and identifies every act concerned. This matters for connected products, such as devices that also fall under radio equipment or other product legislation, where separate declarations would otherwise conflict or duplicate content.
- Trigger: two or more Union acts each require an EU declaration for the same product.
- Identification: every act concerned must be named, with its reference, in the single declaration.
- Behind the scenes: map each act's requirements to evidence, so that the combined text can be defended for each one separately.
- Ownership: assign one owner who tracks changes to each act, since an amendment to one act can make the combined text inaccurate.
- Common mistake: a combined declaration that omits one of the acts, often a secondary law the team did not list during planning. Build the act list from a legal review of the product's obligations rather than from the first act the team thought of.
Check the list of acts against the product's regulatory assessment before every release, not only at initial launch.
How an assessor checks the declaration and CE marking
This table compares each check an assessor or market surveillance authority runs on the EU declaration of conformity and the CE marking, with the evidence to prepare and the defect that usually appears. Read it as a pre-assessment checklist: each failed row maps to a formal non-compliance point that Article 58(1) requires authorities to end.
| Check | How the assessor tests it | Evidence requested | Common finding |
|---|---|---|---|
| Annex V structure | Compares the declaration section by section against the Annex V model in Article 28 | Signed declaration in the Annex V layout with product, manufacturer and signatory details | Declaration is a free-form letter missing required elements, treated as an incorrect declaration under Article 58(1) |
| Annex I statement | Confirms the statement that applicable Annex I requirements are met traces to the risk assessment and technical file | Risk assessment, Annex VII technical file index, and the standards or specifications cited | Declaration claims conformity for requirements the documented risk assessment never addressed |
| Version and date after changes | Checks that the declaration was updated after substantive changes and that the version matches the shipped product | Version history showing revisions, dates and the release each declaration covers | Declaration dated before a later release, or one version reused across products with different features |
| Languages by market | Matches the languages of the declaration against each market where the product is sold | List of target markets and the language versions held for each | Declaration supplied only in English for markets requiring the national language |
| CE marking visibility | Inspects the product, packaging or accompanying documentation for a visible, legible and indelible mark | Photographs of the marking on hardware, or the placement location for software | Marking is too small, faded or absent, or placed where users cannot see it before purchase |
| Notified body number | Checks whether module H applies and, if so, that the CE marking carries the notified body identification number | Conformity assessment route record and notified body certificate reference | Module H involved but the number is missing, a common basis for a Article 58(1) finding |
| Simplified declaration link | Opens the internet address given in the simplified declaration and checks it resolves to the full declaration | Live URL, access record, and confirmation the linked page shows the current full declaration | Link is broken, points to a login page, or resolves to an older version |
| Combined declaration scope | Checks that one declaration lists every Union act that requires a declaration for the product | Register of applicable Union acts and the single combined declaration | Declaration names only the CRA while other applicable acts remain undeclared |
Drawing up the declaration and marking in six steps
This sequence takes a product from a confirmed conformity route to a published EU declaration of conformity and CE marking that a market surveillance authority can check. Each step closes with a record that the next step depends on, so gaps surface before the product is placed on the market.
Confirm the classification and conformity route
Start by confirming whether the product is a default product, an important product in Annex III class I or class II, or a critical product in Annex IV. The classification sets the conformity assessment route under Article 32, and that route decides whether a notified body must be involved at all. Product management and the compliance lead should own this step and record the category, the Annex III or IV entry it matches, and the route selected. The step is complete when the classification memo is signed off and the route is written into the technical file index.
Confirm the Annex I position in the risk assessment
Check that the cybersecurity risk assessment supports the statement that the applicable Annex I essential requirements are met. The declaration is a statement of responsibility, so it should not rest on an assessment that is out of date or does not cover the product as shipped. Security engineering and the product owner should cross-check each applicable requirement against the risk assessment and the technical file, noting where a harmonized standard, common specification or certification scheme is applied. The output is a reconciled matrix that shows which Annex I requirements apply and the evidence behind each one.
Identify every Union act and choose the declaration format
List all Union acts that the product falls under and that require an EU declaration of conformity. Where more than one act applies, Article 28(3) requires a single declaration that identifies all of them, so legal and compliance teams should decide whether to combine the declarations or keep them separate. Confirm this with counsel where product lines sit across several sectoral laws. The step closes when the list of acts and the chosen format are recorded, along with the decision on whether the simplified declaration under Article 13(20) will be used for any distribution channel.
Draft the declaration in the Annex V structure and translate it
Draft the declaration following the Annex V model, stating that the applicable Annex I requirements are met and identifying the product, the manufacturer and the standards or specifications applied. The manufacturer signs it and thereby assumes responsibility for compliance. Confirm with local counsel which languages each Member State requires where the product is sold, then produce the translated versions and check them against the source text. If a simplified declaration is used, the exact internet address of the full declaration must be included. The output is a signed, versioned declaration set with a translation record for each market.
Affix the CE marking in the form the product allows
Affix the CE marking visibly, legibly and indelibly on the product, or on its packaging or accompanying documents where the product format requires it. For software, Article 30 allows the marking on the EU declaration of conformity or on the accompanying website, in a section that consumers can reach easily and directly. Where module H applies, place the identification number of the notified body directly after the CE marking. Product engineering and labeling should photograph the final marking and store the image with the file. The step closes with a marking record for each product version.
Publish, version and set a review trigger
Publish the declaration and make it reachable for the authorities and for the buyers and users who need it, using the address or channel named in the declaration. Store every version under version control so that the signed text, the date and the person who approved each change can be shown later. Set a review trigger that reopens the declaration when the product is substantially modified, when the risk assessment changes, or when a new Union act or applicable standard enters into force. The output is a published declaration with a documented history and a named owner for the review trigger.
Evidence that passes and how to keep it current between audits
An Article 28 declaration and its CE marking are only as credible as the records behind them. The cards below cover the artifacts an authority or notified body is likely to ask for, and the version and access controls that keep them accurate after the first release.
Signed declaration in the Annex V structure
The EU declaration of conformity must follow the Annex V model and state that the applicable Annex I requirements are met. Keep the signed original, with the signatory's name and function, the product identification, and the list of Union acts if more than one applies. Check that the declaration names the product version it covers, because a declaration that does not match the shipped build is a formal defect. Confirm with your legal team who signs and under which authority.
Version history of the declaration
Article 28 allows the declaration to be updated as appropriate, so you need a record of each revision, what changed, when and who approved it. XWiki (LGPL-2.1-or-later) keeps every change to a page under version control, records what changed, when and by whom, and lets users compare any two versions and roll back. Confirm that your deployment's page history and export settings meet your retention needs before you rely on it as evidence.
Publishing rights set by role
A declaration that anyone can edit is hard to defend. BookStack (MIT) assigns abilities through roles and lets you override permissions per role at the shelf, book, chapter or page level, so only authorized staff can publish or change the declaration. Map each role to a named responsibility, such as drafter, approver and publisher, and review the assignments whenever staff change. Confirm that the override model fits how your compliance team is organized.
CE marking proof and label photographs
For hardware, keep dated photographs of the affixed CE marking on the product and its packaging, showing it is visible, legible and indelible. For software, keep a dated capture of the website section where the marking is shown, which must be easily and directly accessible to consumers. Record the product version each capture covers, so a later release is not assumed to carry the same marking.
Notified body number and certificate reference
Where module H applies, the CE marking must be followed by the notified body's identification number. Keep the certificate reference and number in the declaration file and on the marking record, and confirm the body's status against the Commission's NANDO listing before publication. A missing or wrong number is treated as formal non-compliance, so check it against the certificate rather than copying it from an earlier product.
Simplified declaration link check record
If you supply the simplified declaration under Article 13, it must give the exact internet address of the full declaration. Keep a dated record of each link check, showing the address resolves to the current full declaration for the right product version. Repeat the check after every release and after any site migration, because a broken or outdated link fails the requirement even when the full declaration is correct.
What the declaration and CE marking cost to meet and maintain
This table compares each cost component of drawing up the EU declaration of conformity and affixing CE marking, showing who is paid, whether the cost is one-time or recurring, and what drives it up. Use it to build a written scope before asking for quotes. Notified body fees appear only where module H applies, and no figures are given beyond those the regulation text supports.
| Cost component | One-time or recurring | What drives it and how to keep it down |
|---|---|---|
| Internal legal and compliance time to draft and review the declaration | One-time per product version, then recurring on updates | Number of Union acts cited in one declaration and number of product versions. Keep a single template aligned to Annex V and reuse it across products. |
| Engineering time to set the CE marking mechanism | One-time, then recurring when the marking changes | Whether the mark sits on the declaration or on a software website section. Agree the placement early so builds do not need rework. |
| Engineering time for the website section (software) | One-time build, recurring upkeep | Number of sites, languages and release channels. Publish the declaration from the same source as the release notes to limit manual edits. |
| Translation of the declaration | Recurring per language and per update | Languages required in each market where the product is sold and how often the text changes. Confirm the language list with national counsel before quoting. |
| Publication and version control tooling | Recurring hosting and administration; software licence spend removed for XWiki and BookStack | XWiki and BookStack are open source, so licence fees are avoided. Hosting, backups, access roles and admin time remain and should be scoped in writing. |
| Notified body fees (module H only) | Recurring under the notified body's written offer | Only applies where full quality assurance under module H is used. Request a fee schedule, the acts covered, and the identification number to be affixed. |
| Auditor or assessor time when an external review is commissioned | Optional, per review | Scope of review, number of products and documents, and whether the review follows a fixed scope. Ask for a written scope listing the acts, languages, markets and product count before accepting a quote. |
Who owns the declaration, who prepares evidence and who issues conformity
The manufacturer owns the EU declaration of conformity. By drawing it up, the manufacturer assumes responsibility for the product meeting the applicable Annex I requirements, so the signature, the product decisions behind it and the affixing of the CE marking stay with people inside the organization. Under Article 28 the declaration must follow the Annex V model, state that the applicable requirements are met, be kept up to date and be available in the languages required where the product is sold.
- Signature and authority: a named person with authority to bind the company signs the declaration and accepts the consequences of that statement.
- Product decisions: the team decides which Annex I requirements apply, which harmonized standards are used and whether the conformity assessment route is met.
- Currency: the team updates the declaration when the product, its version or its applicable acts change.
- CE marking: the team affixes the marking visibly, legibly and indelibly, or on the software website section where Article 30 allows it.
- Language and access: the team confirms language versions and the internet address used in any simplified declaration.
Confirm internally who holds each of these roles before any outside work begins.
An implementation partner such as DeployOpen prepares the material the declaration rests on. It can draft the declaration structure against the Annex V model for the manufacturer to review, set up the publication location and version history, and check that the CE marking, the declaration and any links are present and consistent. The partner works inside the scope agreed in writing and does not sign, certify or issue anything on the manufacturer's behalf.
- Evidence preparation: gathering test results, build records and vulnerability handling records that support the statements in the declaration.
- Drafting support: producing a draft structure and wording for internal legal and product review.
- Publication setup: configuring a self-hosted documentation platform so each declaration version is retained with its change history.
- Marking and link checks: verifying that the CE marking location and the declaration addresses work as intended.
- Boundaries: the partner does not decide compliance, sign the declaration or substitute for the manufacturer's legal review.
Ask any partner to write its scope, deliverables and handover of records in writing before work starts.
An independent auditor or notified body does not work for the manufacturer in the sense of preparing its documents. Where the route requires third-party involvement, it assesses the product or the manufacturer's quality system and issues the certificate or report that the route calls for. Under Article 32 a notified body is needed for class I important products where harmonized standards are not applied in full, and for class II and critical products. Most default products follow self-assessment instead.
- Assessment: the body reviews technical documentation and the quality system against the applicable route.
- Issuance: only the assessor issues the certificate, and a notified body number is then shown with the CE marking under module H.
- Independence: because the assessor must stay independent, the implementation partner may not write or edit the assessor's findings or reports.
- Scope limits: the assessor's review covers what the manufacturer submits, so gaps in submitted evidence remain the manufacturer's responsibility.
- Notification status: Member States notify notified bodies, and the Commission lists them in NANDO.
Confirm the route, the body's notification status and its own fee and timeline in writing before engaging it.
Some work can be outsourced without moving responsibility. Drafting support, publication setup, evidence checks and marking verification are commonly handled by an outside team, while signature, responsibility and product decisions normally stay in-house. The split is clearest when each deliverable has a named owner on both sides and a record of who approved what.
- Usually outsourced: draft declaration structure, document publication setup, version history configuration, evidence collection and link checks.
- Usually in-house: signing, accepting legal responsibility, choosing standards and risk decisions, and approving each declaration version.
- Version control: keep each declaration version and its change log so the manufacturer can show what changed, when and by whom.
- Access control: limit who can edit and who can approve published declarations, using role-based permissions.
- Handover: agree in writing which records the partner transfers and in what format.
Before engaging anyone, confirm which party will hold the signed declaration, the technical file and the publication credentials.
Questions buyers ask about the EU declaration and CE marking
Can a manufacturer write the EU declaration of conformity itself?
Yes. Article 28 requires the declaration to follow the Annex V model, and by drawing it up the manufacturer assumes responsibility for compliance, so the manufacturer is the party that must stand behind it. Nothing in the regulation requires an outside firm to write it. The work needs someone who can match each applicable Annex I requirement to evidence, confirm which other Union acts apply, and keep the wording consistent with the technical documentation. An internal team can do this if it owns the technical file and has engineering sign-off. An implementation partner can prepare the draft, the evidence index and the cross-references, but the manufacturer's authorized signatory should review and sign. Confirm the signatory and approval chain with your legal team before work starts.
How long does drawing up the declaration take?
The drafting itself is usually the shortest step. The duration depends mostly on how ready the evidence is. The main drivers are the number of products and variants covered, whether one combined declaration must cover several EU laws under Article 28(3), how complete the technical documentation already is, whether harmonized standards are applied in full, whether a notified body must be involved, and how long your internal approval cycle takes. Timing also depends on your market dates: the reporting obligations under Article 14 apply from 11 September 2026, and the regulation applies in full from 11 December 2027. Ask for a written timeline with milestones and named owners, tied to the scope you agree before work starts.
What does the declaration work need from engineering and legal?
Engineering supplies the facts the declaration states. That includes the product's cybersecurity risk assessment, the configuration and architecture the declaration describes, the basis for the support period, test results, the software bill of materials where relevant, and records showing the vulnerability handling processes operate. Legal and compliance decide which Union acts apply, which languages the declaration must be available in where the product is sold, who has authority to sign, and how each version is approved and retained. Both teams should agree on one version of the facts, because the declaration must stay accurate as the product changes. Version control on the declaration and its evidence makes that agreement easier to check. Budget time for both teams in the quote, since their review usually sets the pace.
Does software need CE marking, and where does the mark go?
Software that falls within the regulation must carry the CE marking once conformity has been demonstrated. Article 30(1) requires the mark to be affixed visibly, legibly and indelibly. For software, the mark may be placed on the EU declaration of conformity or on the website that accompanies the software, in a section that consumers can reach easily and directly. Whichever place you choose, the mark should lead to a declaration that is current and easy to find. Check the exact placement rules in the article text and confirm with your legal team how they apply to your distribution channels, because a web page that is hard to locate can create a compliance gap of its own.
When is a notified body number required next to the CE mark?
A notified body number must follow the CE marking when a notified body takes part in the conformity assessment under module H, which is full quality assurance. Article 30(4) sets that rule. Most products follow self-assessment under module A, so they do not carry a notified body number for that reason. Class I important products, class II products and critical products can follow routes that involve a notified body, and the Commission's guidance explains when that applies. Confirm your product's category and route before you finalize the declaration, because an omitted or incorrect number is treated as formal non-compliance under Article 58.
Is a simplified EU declaration enough for my product?
A simplified declaration can be enough for the public-facing step, but it does not replace the full declaration. Article 13(20) allows a manufacturer to supply the simplified declaration in the Annex VI form, provided it gives the exact internet address where the full declaration can be accessed. The full declaration must still exist, match the product, and stay current at that address. Where a product is subject to more than one Union act that requires a declaration, Article 28(3) requires a single combined declaration that identifies every act concerned. Choose the simplified route only if you can keep the linked page stable, versioned and accurate for the full support period.
What happens if the declaration is wrong after release?
Authorities treat a missing or incorrect declaration as formal non-compliance and must require the manufacturer to end it, under Article 58(1). In practice, you should correct the declaration, reassess the evidence behind the statement that the Annex I requirements are met, and record what changed, when and why. Article 28 allows the declaration to be updated as appropriate, so a corrected version is the expected response to a defect in the text. Fines are separate from that corrective duty. Article 64 sets maximums by breach category, and the highest tier for incorrect or misleading information given to authorities is EUR 5 million or 1% of total worldwide annual turnover, whichever is higher. Ask any partner to include a correction procedure in the scope.
Can a partner sign or certify the declaration on our behalf?
No. The manufacturer drawing up the declaration is the party responsible for it, and an implementation partner cannot sign it in the manufacturer's place or certify conformity for it. Only an independent auditor, assessor or certification body issues audit reports and certificates, and a notified body acts only where the route requires one. DeployOpen plans, prepares and documents the systems, controls and evidence that support the declaration, and it does not issue declarations, reports or certificates. Ask for the scope of drafting, review and evidence assembly in writing, and confirm who holds signature authority. The cost table on this page shows which parts of this work are usually priced separately.
How DeployOpen prepares the declaration and evidence for your team
DeployOpen prepares the systems, documentation and evidence that support your EU declaration of conformity and CE marking, working inside your own infrastructure. Your organization owns the declaration and takes responsibility for compliance, while an independent notified body is involved only where the applicable route requires one.
How we scope
- Confirm which products, versions and Union acts the declaration must cover, identified in a written scope before work starts.
- Agree in writing which Annex I requirements and harmonized standards your team will reference in the declaration.
- Identify whether a single combined declaration or the simplified Annex VI form applies to each product, and which notified body number is needed.
How we build
- Draft the declaration to the Annex V model, with product identification, applicable requirements and the signatory details for your review.
- Prepare the technical documentation references, support period statements and the internet address for any simplified declaration.
- Set up CE marking placement for hardware, or the website section or declaration reference for software, and record each change in version control.
How we hand over
- Deliver the draft declaration, marking specifications and an evidence index mapping each statement to a stored artifact.
- Document who in your organization approves, signs and updates the declaration when a product is substantially modified.
- Train the responsible staff on keeping declarations current, in the languages required where each product is sold.
How we support
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- Ongoing support, upgrades and continuous testing are available as a retainer to keep declarations aligned with product changes.
- Confirm with your legal counsel, notified body and national authority any question on applicability, language or notified body involvement.
Sources and further reading
- Regulation (EU) 2024/2847, Article 28 (EUR-Lex) ↗
- Regulation (EU) 2024/2847, Article 30 (EUR-Lex) ↗
- Regulation (EU) 2024/2847, Annex V (EUR-Lex) ↗
- Regulation (EU) 2024/2847, Article 13 (EUR-Lex) ↗
- Regulation (EU) 2024/2847, Article 58 (EUR-Lex) ↗
- Commission FAQs on the Cyber Resilience Act, version 1.4 ↗
