The EU declaration of conformity for connected devices: the CRA section beside RED and EMC

A connected device sold in the EU already carries an EU declaration of conformity: under the Radio Equipment Directive (RED, Directive 2014/53/EU) if it has a radio, or under the EMC Directive (2014/30/EU) and whichever other acts apply if it does not. From 11 December 2027 the Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) adds its own requirements and its own declaration (Article 71(2)). This guide explains how the CRA part fits with the rest. It is a documentation aid, not legal advice.

Where this guide says something had not been published or designated "when we last checked", that was 8 October 2026. The source list at the end gives the date each source was read.

One declaration, not two

Both laws say the same thing about overlap. CRA Article 28(3): where a product "is subject to more than one Union legal act requiring an EU declaration of conformity, a single EU declaration of conformity shall be drawn up in respect of all such Union legal acts". RED Article 18 says the same for radio equipment, and both require the single declaration to identify each act with its publication reference.

So the practical result for most connected devices is one declaration that names the RED (or the EMC Directive and the other acts that apply) and the CRA, each with its Official Journal reference.

Which laws a typical device declares under

A device with a radio (Wi-Fi, Bluetooth, LTE-M, LoRa and so on) is radio equipment. RED Article 3(1) builds the electrical safety and electromagnetic compatibility objectives into the RED itself: radio equipment must ensure "an adequate level of electromagnetic compatibility as set out in Directive 2014/30/EU". The EMC Directive, in turn, does not apply to "equipment covered by Directive 1999/5/EC" (Article 2(2)(a)), and the RED repealed that directive and says references to it are read as references to the RED (RED Article 50). So a radio device declares under the RED, which carries EMC with it, not under the EMC Directive separately.

A device without a radio (wired Ethernet, a USB peripheral) is outside the RED, so the EMC Directive applies to it directly, alongside any other act whose scope it falls in (argument: check each act's own scope article).

From 11 December 2027, both kinds add the CRA if they are products with digital elements made available on the market whose intended or reasonably foreseeable use includes a data connection to a device or network (CRA Article 2(1)).

Every other act that requires a declaration and applies to your product joins the same single declaration (CRA Article 28(3)).

What the CRA declaration must say

CRA Article 28(1) says the manufacturer draws up the declaration and states "that the fulfilment of the applicable essential cybersecurity requirements set out in Annex I has been demonstrated". Article 28(2) says it follows the model structure in Annex V, contains "the elements specified in the relevant conformity assessment procedures set out in Annex VIII", "shall be updated as appropriate", and is made available in the languages the Member State requires. Annex V lists these items:

1. Name and type of the product, and anything else that uniquely identifies it.
2. Name and address of the manufacturer or its authorised representative.
3. A statement that the declaration is issued under the sole responsibility of the provider.
4. The object of the declaration, identified so it can be traced (a photograph may be included).
5. A statement that the object is in conformity with the relevant Union harmonisation legislation.
6. References to any harmonised standards, common specifications or cybersecurity certification used.
7. Where applicable, the notified body's name and number, the procedure performed and the certificate issued.
8. Additional information; signed for and on behalf of; place and date of issue; name, function and signature.

The RED's own model (its Annex VI) asks for the same kind of information, so the two merge without strain: one product identification, one manufacturer block, one list of acts, one list of standards, one signature.

Firmware is part of the identification

For the CRA the product includes its software. The technical documentation must describe the "versions of software affecting compliance with essential cybersecurity requirements" (Annex VII, point 1(b)), and Article 28(4) says that by drawing up the declaration the manufacturer "shall assume responsibility for the compliance of the product".

So name the firmware versions that were actually assessed, and only those, in the same words as the technical documentation: for example "firmware 2.3.0 and 2.3.1". Do not write "and later versions". A version that does not exist yet has not been assessed, and the declaration would vouch for it anyway.

Update the declaration when a version changes the security assessment. Our reading (argument) of the "updated as appropriate" duty in Article 28(2): a new version joins the declaration only after you have checked it against the assessment, and a version that changes the assessment means the assessment is redone before the declaration names it.

Variants follow the same rule: name each variant the declaration covers by its exact type designation, never a series name or an open-ended family. For example "ColdTrace S2 (type CT-S2-EU), S2 XL (type CT-S2XL-EU) and S2 LTE (type CT-S2L-EU)", not "the CT-S2 series". You sign for every product the declaration names, so name only variants someone has assessed: "the CT-S2 series" also signs for a model you add next year, and if that model has a different radio or update mechanism, your signature covers it before anyone has assessed it. Annex V point 1 asks for information "enabling the unique identification" of the product. The Commission's draft guidance (C(2026) 5252, not binding and applying only once formally adopted) allows one declaration for a group of variants "as long as it clearly identifies the product variants to which it applies" (point 175), and adds: "Reliance on a single conformity assessment is only possible to the extent that the products with digital elements do not present differences with regards to their cybersecurity properties" (point 177). Our reading (argument): a series name identifies no product uniquely, and a new variant joins the declaration through Article 28(2)'s "updated as appropriate", after it has been assessed. Our guide Choosing and changing your support period covers variants with different support end dates.

The standards line, honestly

When we last checked (argument: we have not found one in the Official Journal; check it again before you rely on this), no harmonised standard for the CRA is cited in the Official Journal. That has two consequences.

• The standards item cannot claim a presumption of conformity from a CRA standard. Say so plainly, and list by number any other specifications you applied (for example ETSI EN 303 645).
• For important class I products, Article 32(2) requires a notified body procedure (EU-type examination followed by internal production control, or full quality assurance) where harmonised standards, common specifications or European cybersecurity certification schemes at assurance level at least "substantial" were not applied, were applied only in part, or do not exist. Our reading (argument): until one of those is available to apply in full, that is the position for a class I product, with one exception the law states itself. Free and open-source software in this class may use any route in Article 32(1), including internal control (module A), if its technical documentation is public when it is placed on the market (Article 32(5)). When we last checked, no notified body had yet been designated under the CRA in the Commission's NANDO database; Article 35(2) asks Member States to strive to have enough of them by 11 December 2026. So there may not yet be one to apply to: check NANDO before you plan the assessment. Default-category products can still use internal control (module A) under Article 32(1). Class II and critical products have their own routes (Article 32(3) and (4)).

The RED side is different: EN 18031-1, -2 and -3 are cited for the RED's cybersecurity requirements, with restrictions (Implementing Decision (EU) 2025/138). Those RED requirements come from Delegated Regulation (EU) 2022/30, which Delegated Regulation (EU) 2026/339 repeals with effect from 11 December 2027, the day the CRA applies. See our guide The CRA and the RED side by side.

Who signs, and what signing means

Article 28(4): "By drawing up the EU declaration of conformity, the manufacturer shall assume responsibility" for the product's conformity. Evidence: the manufacturer draws up the declaration (Article 28(1)); a manufacturer may appoint an authorised representative by written mandate (Article 18(1)), and Annex V, item 2 names either of them. Our reading (argument): the signatory must be able to bind the company, and a tool, a consultant or a test lab can prepare a draft but cannot issue it.

What goes with the product, and how long you keep it

Two duties follow the signature, and both are the manufacturer's.

Something goes with every product. Article 13(20): manufacturers "shall either provide a copy of the EU declaration of conformity or a simplified EU declaration of conformity with the product". The simplified one is the short form in Annex VI: one sentence saying that the manufacturer declares the product type is in compliance with Regulation (EU) 2024/2847, and one giving the internet address of the full text. Article 13(20) requires it to "contain the exact internet address at which the full EU declaration of conformity can be accessed". It does not replace the full declaration: the full one is still drawn up and signed, and the address has to lead to it. Like the full declaration, it is made available in the languages the Member State requires (Article 28(2)).

The simplified declaration is not the simplified technical-documentation form. That form is a separate thing for micro and small enterprises, described under "What is settled and what is not" below, and it concerns the technical documentation, not what ships with the product.

The declaration and the technical documentation are kept. Article 13(13): manufacturers keep both "at the disposal of the market surveillance authorities for at least 10 years after the product with digital elements has been placed on the market or for the support period, whichever is longer". Our reading (argument): the period runs for each unit from the day that unit is placed on the market, so the last unit placed on the market sets the end date, and a declaration that was later updated is kept in each signed version, because units were placed on the market under each one.

A practical order of work

1. List the acts that apply to the product today and from 11 December 2027.
2. Write one product identification, naming each variant by its exact type designation (never a series or family name), with its hardware type and the firmware versions you have assessed, and use it everywhere: declaration, technical documentation, user information.
3. Reuse your RED or EMC declaration as the base; add the CRA with its reference and the Annex I statement.
4. Write the standards line per act, with numbers and years only.
5. Record the procedure per act; for the CRA, that follows from the product's category.
6. Check each new firmware version or variant against the assessment before the declaration names it. Update the declaration when a version changes the security assessment.
7. Ship and keep. Put a copy of the declaration, or the Annex VI simplified declaration with the address of the full text, with the product (Article 13(20)). Keep every signed version and the technical documentation for at least 10 years after the product is placed on the market, or for the support period if that is longer (Article 13(13)).

What is settled and what is not

Settled (evidence): the single-declaration rule in CRA Article 28(3) and RED Article 18; the Annex V contents; the CRA application date; the assessment routes in Article 32; the manufacturer's responsibility under Article 28(4); the copy or simplified declaration that goes with the product (Article 13(20) and Annex VI); the keeping period in Article 13(13).

Not settled: which harmonised standards the CRA will cite, and when. The Commission is to set, by implementing act, a simplified technical-documentation form for micro and small enterprises (Article 33(5); Commission MSME page); none had been published when we last checked. Our reading (argument): it would concern how the technical documentation is written, not the declaration or the simplified declaration in Annex VI. The Commission's guidance on variants (C(2026) 5252, points 174 to 177) is a draft until formally adopted. We update this guide when any of these lands.