CRA Declaration of Conformity Generator: the Annex V template, filled in
Every CE-marked product ships with an EU Declaration of Conformity, and the Cyber Resilience Act adds its own. Annex V of the regulation fixes what it must contain: the product and its identification, the manufacturer, the conformity assessment procedure, the standards applied, and the period during which security updates will be provided.
This generator asks for those fields and composes the declaration for you, ready to copy, download and put in front of whoever signs it. It also does something templates never do: it tells you what that signature presumes, and warns you when your answers leave a hole, such as a Class II route with no notified body cited.
By submitting this form, you accept our Terms and acknowledge that Regulus will process your data to provide CRA Declaration of Conformity. For more details, see our Privacy Policy.
The sentence that matters is item 3
Every declaration contains the same line: “This declaration of conformity is issued under the sole responsibility of the manufacturer.” That sentence is the entire mechanism of CE marking. Nobody stamps your product for you; you declare, and the declaration is only as good as the file behind it.
Under the CRA, the file behind it means:
- The technical documentation described in Annex VII: design, development, vulnerability handling, and how each Annex I requirement is met.
- A cybersecurity risk assessment for the product, kept up to date through its life.
- The Annex I conformity record, requirement by requirement, with evidence.
- A software bill of materials covering at least the top-level dependencies.
- A vulnerability handling process, including the reporting duties that start on 11 September 2026.
A declaration generated in two minutes and signed without those five things is not a shortcut. It is a signed statement that they exist, kept for ten years, available to market surveillance authorities on request. That is why the generator prints this list under every declaration it produces.
What Annex V actually requires
The declaration must identify the product unambiguously (name, type, batch or serial), name the manufacturer and any authorised representative, state conformity with the essential requirements of Annex I, cite the harmonised standards or other specifications applied, name the notified body and certificate where one is involved, and state the support period during which vulnerabilities will be handled.
Two details are routinely missed. The declaration must be translated into the languages required by each member state where the product is sold. And it must be kept for ten years after the product is placed on the market, updated whenever the product changes in a way that affects conformity. A declaration is not a document you write once; it is a document you maintain.
FAQs
Is there an official template for the CRA Declaration of Conformity?
Annex V of Regulation (EU) 2024/2847 fixes the structure and content. There is no separate official form to download; any document containing the Annex V elements is valid. This generator follows that structure.
Who has to sign the Declaration of Conformity?
Someone authorised to bind the manufacturer, typically a director or officer. The declaration is issued under the manufacturer’s sole responsibility, which is why the signature usually sits higher in the organisation than the engineering team that prepared the file.
Can one declaration cover several products?
One declaration covers one product or product family with the same conformity basis. Variants sharing a platform, a codebase and an update mechanism can usually share a declaration; distinct products cannot.
Does the CRA declaration replace our existing one under RED or EMC?
No. You can issue a single declaration listing all applicable Union legislation, or separate ones. Most manufacturers extend their existing declaration with the CRA reference once the technical file exists.
What happens if we sign without the technical file?
The declaration asserts the file exists. If market surveillance requests it and it does not, the product can be withdrawn from the market and the manufacturer fined, with penalties under the CRA reaching EUR 15 million or 2.5 percent of worldwide turnover, whichever is higher.
Early Access for CRA Compliance Tools 🇪🇺
Join Early Access — Save 20%