CRA Annex VII — Technical Documentation (8 Points Explained)

Key figures

Elements required in the technical documentation under Annex VII

10 yr

Minimum retention period per Annex VIII Part I point (4.2)

Art. 31

Legal basis for the technical documentation obligation

How CRACheck structures the 8 Annex VII elements

General product description (Annex VII §1)

You enter the product's intended purpose, software versions affecting compliance, hardware photographs/illustrations if applicable, and user information per Annex II. CRACheck structures this as the opening section of the technical documentation.

Design, development, production & vulnerability handling (Annex VII §2)

You describe the system architecture, software component dependencies, the SBOM (top-level), the CVD policy, the contact address for vulnerability reporting, the mechanism for distributing security updates, and the production monitoring processes.

Cybersecurity risk assessment (Annex VII §3)

CRACheck generates the risk assessment framework per Article 13(2)–(3), mapping each applicable Annex I requirement to identified risks, implemented mitigations, and residual risk levels.

Support period rationale (Annex VII §4)

You declare the support period and the factors considered per Article 13(8): expected product lifetime, market comparables, operating environment availability, and third-party component support periods.

Standards and specifications (Annex VII §5)

You declare which harmonised standards, common specifications, or European cybersecurity certification schemes have been applied, in full or in part. Where none have been applied, you describe the alternative technical solutions adopted.

Test reports (Annex VII §6)

You reference or attach the results of conformity tests. CRACheck provides a structured section for test scope, methodology, results, and date.

EU Declaration of Conformity (Annex VII §7)

CRACheck generates the Declaration per Article 28 and Annex V, embedded as a section of the technical documentation.

Common mistakes

❌

ANNEX VII · §2

Treating the SBOM as optional

Annex VII §2(b) requires "the software bill of materials" as part of the vulnerability handling processes. Annex I Part II point (1) requires the manufacturer to draw up an SBOM in a commonly used and machine-readable format covering at least the top-level dependencies. The SBOM is not optional — its existence must be documented in the technical file.

❌

ART. 31(2)

Creating the documentation once and never updating it

Article 31(2) states that the technical documentation "shall be continuously updated, where appropriate, at least during the support period." A static document produced in 2027 that is never revised for new vulnerabilities, updated components, or changed standards does not comply.

❌

ANNEX VII · §5

Claiming harmonised standards without specifying which parts were applied

Annex VII §5 requires a list of harmonised standards applied "in full or in part." If applied only in part, the technical documentation must specify the parts applied. A blanket "EN standard applied" without identifying specific clauses is insufficient.

What the ZIP contains

8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.

Product Classifier

Identifies your product category and the conformity assessment module. Corresponds to Annex VII preamble requirements.

Technical Documentation

The core Annex VII file. Contains all 8 required elements: product description, design and development, risk assessment, support period, standards, test reports, Declaration, SBOM reference.

Risk Assessment

Cybersecurity risk assessment per Article 13(2)–(3). Corresponds to Annex VII §3.

User Information

Annex II information sheet. Referenced in Annex VII §1(d).

Declaration of Conformity

EU Declaration per Article 28 and Annex V. Included in the technical file per Annex VII §7.

CVD Policy

Coordinated vulnerability disclosure policy. Part of the design and development section per Annex VII §2.

Notification Template

ENISA/CSIRT notification template per Article 14. Art. 14(2): early warning within 24h, notification within 72h, final report within 14 days.

Obligations Calendar

Key dates including the 10-year retention obligation and support period milestones.

See before you buy — Download sample dossier (PDF, fictional company) — Real structure, real articles, real format. Fictional data.

Generated from your data, in your browser. No data leaves your device.

What you pay

🧾 THE ALTERNATIVE

Technical documentation consultancy

€10,000–25,000 per product

2–6 months

Requires deep access to your engineering team

Deliverable format varies

✓ CRACHECK

€149 per product

15–25 minutes

8 structured PDFs covering all 8 Annex VII elements

You fill the data; CRACheck organises it into the required structure

30-day edit window. 10 regenerations

Two layers

● LAYER 1 — DOCUMENTATION · CRACHECK

Article 31 + Annex VII documentation

CRACheck generates the Article 31 + Annex VII technical documentation file with all 8 required elements structured and cross-referenced.

∅ LAYER 2 — NOT INCLUDED

What CRACheck does not do

CRACheck does not review the accuracy of your engineering inputs. It does not audit your SBOM, test your product, or validate your risk assessment. The data you enter is the data that appears in the documentation. Accuracy is your responsibility under Article 13.

CRACheck structures. You substantiate.

Enforcement regime

⚖️

€15M / 2.5% — Art. 64(2)

Non-compliance with Annex I essential requirements.

⚖️

€10M / 2% — Art. 64(3)

Missing or incomplete Art. 31 technical documentation.

⚖️

€5M / 1% — Art. 64(4)

Incorrect or misleading information in the documentation.

Alternatives

Criterio	DIY from regulation text	Consultancy	CRACheck
Price	Free (internal time)	€10,000–25,000	€149
Delivery	Weeks to structure	2–6 months	15–25 minutes
Risk of missing elements	High	Depends on consultant's CRA expertise	All 8 Annex VII elements covered
Format	Varies	Varies	8 structured PDFs
Data handling	Internal	Shared with consultancy	100% browser-side
CRACheck	€149	15-25 min	8 PDFs	Browser-side

Technical documentation for a multi-product portfolio?

Each product with digital elements needs its own Annex VII file. Volume pricing available. Pack of 10: €99. Pack of 30: €79.

Request volume pricing

Commercial enquiries via hello@solidwaretools.com

What CRACheck guarantees and what it does not

CRACheck generates a structured document according to Article 31 and Annex VII of Regulation (EU) 2024/2847, based on the information you enter. The accuracy, completeness, and truthfulness of that information is your responsibility as manufacturer.

We guarantee that the document structure follows Article 31 and Annex VII of Regulation (EU) 2024/2847 and that the legal references cited are correct. We do not guarantee that a specific document will be accepted by a market surveillance authority in a specific case.

CRACheck is not legal advice. For situations specific to your product or market, consult a qualified lawyer or specialised regulatory consultancy.

Frequently asked questions

Does the technical documentation need to be in a specific language?

Article 31(4) of Regulation (EU) 2024/2847 states that the documentation must be drawn up in an official language of the Member State where the notified body is established, or in a language acceptable to that body. For products using Module A (no notified body), the documentation should be in a language required by the market surveillance authority of the Member State where the product is placed on the market.

Can the technical documentation be a single document or must it be separate files?

The regulation does not prescribe a specific file format. CRACheck distributes the content across 8 focused PDFs for clarity and usability, but a market surveillance authority will accept any format that contains all 8 Annex VII elements in a traceable and accessible manner.

What does "continuously updated" mean in Article 31(2)?

Article 31(2) states that the technical documentation "shall be continuously updated, where appropriate, at least during the support period." This means you must update the documentation when the product changes (new firmware, new components), when new vulnerabilities are discovered, when standards are updated, or when the risk assessment changes. CRACheck provides 10 regenerations within the 30-day licence window for this purpose.

Is the SBOM in Annex VII point (8) automatically disclosed?

No. Annex VII point (8) states that the SBOM is provided "further to a reasoned request from a market surveillance authority" and only to the extent "necessary in order for that authority to be able to check compliance with the essential cybersecurity requirements set out in Annex I." It is not published proactively.

Is this a subscription?

No. One-time payment. The licence includes 30 days of editing and 10 regenerations. The downloaded PDF is yours permanently.

Can I request a refund?

Under Art. 16(m) of Directive (EU) 2011/83, activating the licence constitutes express consent for immediate generation of digital content, waiving the 14-day withdrawal right. Refunds are only processed for reproducible technical failures.

What if the regulation changes?

If Regulation (EU) 2024/2847 is amended during your licence window, you can regenerate the documentation using the updated version of the generator at no additional cost.

Official legal sources

Regulation (EU) 2024/2847 — Cyber Resilience Act — full text

⚠️ Important notice: CRACheck is a self-assessment documentation tool, not legal advice and not a third-party audit. The document under Article 31 and Annex VII of Regulation (EU) 2024/2847 is generated from your input data. You are responsible for the accuracy of the data you provide. CRACheck does not replace a qualified professional assessment.