Compliant Book

What goes in a CRA Annex VII technical file

Last reviewed: 11 September 2026~8 min read

Annex VII requires eight things: a product description, the design and development information, a cybersecurity risk assessment, the essential requirements applied, the standards used, test reports, the software bill of materials and the EU Declaration of Conformity. You must draw it up before placing the product on the market and keep it for ten years or the support period, whichever is longer.

The eight sections

1. General description of the product

Intended purpose, versions, and how the product works. Photographs or illustrations of external features, markings and internal layout where relevant. For software, this means the architecture and what the product is for — not marketing copy. Be specific enough that a market surveillance authority who has never seen the product understands what it does.

2. Design, development and production

A description of the design and development process, including the secure development lifecycle. Where applicable, the production process and monitoring. This is where you evidence that security was designed in rather than bolted on — the "secure by design" obligation in Annex I Part I.

3. Cybersecurity risk assessment

Required by Article 13(2) and the beating heart of the file. It must cover the risks the product presents, how the essential requirements address them, and the reasoning behind your decisions. The Commission's 2026 guidance clarifies what is expected to be written down, but supplies no template — you must produce the document yourself.

What auditors look for: a documented method, not a conclusion. A risk assessment that states results without showing how they were reached is the most common weakness.

4. Essential requirements applied

An assessment of which Annex I requirements apply and how each is met. Annex I Part I covers product properties — no known exploitable vulnerabilities on release, secure default configuration, protection against unauthorised access, confidentiality and integrity of data, minimal attack surface, and so on. Part II covers vulnerability handling.

Where a requirement does not apply, say so and say why. Silence reads as an omission.

5. Standards applied

A list of the harmonised standards, common specifications or European cybersecurity certification schemes applied in full or in part. As of September 2026, no CRA harmonised standards are published, so most manufacturers will be documenting other standards used and their own reasoning. Say that plainly rather than leaving the section empty.

6. Reports on tests carried out

Evidence that you verified the product against the essential requirements. Penetration test results, vulnerability scans, code review records, fuzzing output — whatever is proportionate to the product. Proportionality is explicit in the regulation; a mobile app and a smart meter gateway are not held to the same evidential standard.

7. Software bill of materials

Covering at minimum the top-level dependencies of the product. The SBOM must be in a commonly used machine-readable format — SPDX or CycloneDX in practice. SBOM requirements in detail →

8. EU Declaration of Conformity

A copy of the declaration, which is itself a short document naming the product, the legislation applied, the standards used and the signatory. What the declaration must contain →

Also required, alongside the file

  • Support period — the period during which you will provide security updates, determined by reasonable user expectation, and at least five years unless the product's expected lifetime is shorter
  • Coordinated vulnerability disclosure policy — published, with a contact point
  • Information and instructions to the user — Annex II, supplied with the product

How long to keep it

Ten years from placing on the market, or the length of the support period, whichever is longer. Market surveillance authorities can request it, and you must be able to produce it in a language they can understand.

There is no official template, and one is not coming. The Commission's 27 July 2026 guidance contained 67 worked examples and flowcharts but no fill-in forms — matching twenty years of practice across the Machinery Directive, RED, LVD, EMC and the MDR. The regulations enumerate required content; the form is left to the manufacturer, because no single template fits both a smart doorbell and an industrial controller.

Sources