CRA technical file and declaration
The technical file, drafted from what your product already knows.
Five documents the Cyber Resilience Act expects, each started from your SBOM, your findings and the answers you have already given. Every draft records the template and the legal state it was prepared under. You review, edit and sign.
Included in Maker, Studio and Fleet.
- Essential-requirements checklistAnnex I, Parts I and II
The security properties the product must have and the vulnerability-handling duties you carry out, each with your evidence.
- Cybersecurity risk assessmentArticle 13(2) and (3)
What could go wrong with this product, how likely and how bad, and what you do about it.
- Technical documentationAnnex VII
The file you keep to show a market-surveillance authority how the product was designed, built and checked.
- Information for usersAnnex II
What buyers must be told: who you are, where to report a vulnerability, how long security updates last and how to install them.
- EU declaration of conformity (draft)Annex V
The statement you sign that the product meets the CRA's requirements. You sign it; Declarable prepares the draft.
What it does
CRA documents, in 6 parts.
- 01
Five documents, one record
The essential-requirements checklist, the risk assessment, the technical documentation, the information for users and the EU declaration of conformity, all drawn from the same product record.
- 02
Filled from your SBOM, not typed twice
Sections that the record can answer start answered: the component list, the vulnerability handling, the support period. You fill in the rest once.
- 03
Every page says what it was prepared under
Each draft records its template version and the legal-state version. When the law or a template changes, the document says it is out of date.
- 04
Due diligence and the conformity route
A due-diligence record for third-party and open-source components, and the conformity-assessment routes open to your product’s category. The choice of route stays yours.
- 05
One zip for an auditor
Export the prepared PDFs, the current SBOM and your attachments in one zip, with a README listing each file, its status and its checksum.
- 06
History you can show
Every issued revision is kept, with who changed what and when.
How it works
Three steps, the same every release.
- 1
Answer what the record cannot
Each document shows which sections are already filled and asks plain questions for the rest.
- 2
Review the draft
Every section cites the annex point it answers, so you can check it against the Regulation.
- 3
Sign and keep it
You sign the declaration yourself. The issued version is kept with its history for as long as you support the product.
What it does not do
- It does not certify or approve your product. Nobody at Declarable assesses it or signs anything.
- It does not reproduce harmonised standards. They are cited by number, with what the legal state says about each.
Questions
Questions about CRA documents.
What goes into a CRA technical file?
Annex VII lists it: a description of the product, its design and development, the cybersecurity risk assessment, the vulnerability-handling process, the support period, the standards applied, test reports, the declaration and the SBOM.
Who signs the declaration of conformity?
The manufacturer does. Declarable prepares the draft and leaves the signature empty.
What happens when a standard or the guidance changes?
Each document records the legal-state version it was prepared under. When that moves on, the document is marked out of date and you can prepare it again.
Can I try the declaration without an account?
Yes. The free declaration draft tool prepares the CRA section of a declaration of conformity in your browser.
The rest of Declarable
- SBOM monitoringKnow when a new vulnerability reaches your firmware.Read more
- Article 14 reportingThe 24-hour clock, timed and drafted for you.Read more
- Vulnerability disclosureA front door for vulnerability reports, and a place to answer them.Read more
- CI, API and agentsEvery release recorded from the build that made it.Read more
What Declarable is, and what it is not
- A documentation aid. Declarable prepares drafts and checklists for you to review and edit.
- Not legal advice. For a legal question about your product, ask a lawyer.
- Not certification. Nobody at Declarable assesses or signs off your product. You sign your own declaration of conformity.
- Not an assessment body. Some products need an outside assessment body: an product unless its maker fully applies a harmonised standard or one of the alternatives in Article 32(2), and those on the CRA's Annex III class II and Annex IV lists — the higher-risk product categories, where self-assessment is not enough. Declarable is not one. The scope check asks the questions that point to your category.
- Not a filing agent. Declarable does not file reports for you. You submit them yourself on the ENISA platform.
Source for the assessment lists and when an outside body is needed: Annexes III and IV and Article 32 of Regulation (EU) 2024/2847 (Cyber Resilience Act), as recorded in legal state 2026.10.13-1.