EU Cyber Resilience Act · updated 2026-10-19

The technical file: what Annex VII makes you write down

The obligation: before a product is placed on the market, the manufacturer draws up technical documentation containing everything needed to show the product meets the essential requirements (Art. 31). Annex VII lists what goes in it. It applies from 11 December 2027.

The eight parts of the file

1. General description. Intended purpose, software versions affecting compliance, external features and internal layout, user information and instructions (Annex VII, point 1).
2. Design, development and production. System architecture, how components interact, the vulnerability-handling process, the SBOM, the coordinated vulnerability disclosure policy, the contact address for vulnerability reports, how updates are distributed securely (point 2).
3. Risk assessment. The cybersecurity risks against which the product is designed, developed, produced, delivered and maintained. This one is written text, not a tool output; it is the part authorities read first (point 3).
4. Support period. The information you took into account when setting the support period, which must be at least five years or the expected use time (point 4, Art. 13(8)).
5. Standards applied. Which harmonised standards, common specifications or certification schemes you applied, fully or partly, and for anything not covered, a description of the solutions you adopted instead (point 5).
6. Test reports. Reports of the tests carried out to verify conformity of the product and of the vulnerability-handling process (point 6).
7. Declaration of conformity. A copy of the EU declaration (point 7).
8. The SBOM, on request. Produced to a market surveillance authority when needed to verify compliance (point 8).

Who sees it

The file is not published. It stays with the manufacturer and is produced to authorities on reasoned request. Importers must check that it exists before they put your product on the EU market (Art. 19), which is how the obligation reaches a non-EU company through its distribution chain. The one exception is open-source: a manufacturer using the open-source self-assessment route must make the file public (Art. 32(5)).

How long you keep it

At least ten years after the product is placed on the market, or for the support period, whichever is longer (Art. 13(13)). It also has to stay current: when the product changes in a way that affects compliance, the file changes with it.

What a small team gets wrong

Three things, in order of frequency. Treating the SBOM as the whole file, when it is one line item of eight. Writing the risk assessment last, as decoration, when it is the document an authority uses to judge every other part. And producing the file once at launch, then letting it drift from the product for years, so that in 2031 nobody can say which version it describes. A versioned, dated, signed file answers all three.

Two free tools that apply this to your case: the 2-minute applicability check (does the CRA apply to you, with the clauses) and the SBOM generator (CycloneDX + SPDX from your manifest, signed). Neither asks for an account.

Sources, primary only: Regulation (EU) 2024/2847 (EUR-Lex) · European Commission, CRA summary · European Commission, CRA reporting · ENISA, Single Reporting Platform. This is not legal advice; the regulation text controls.

← All explainers