Technical documentation (Annex VII)

The technical documentation is the deliverable of the CRA. It is what a market surveillance authority asks for, what a notified body examines, and what the EU declaration of conformity rests on.

It is also the document that embodies the Legal–Cyber interface: the former structures and retains it, the latter produces most of its content.

The standard structure

1. General description of the product

Intended purpose, versions covered, photographs or illustrations showing external features, marking and internal configuration, description of software and hardware, information and instructions to the user (Annex II), installation instructions.

2. Design, development, production and vulnerability handling

This is the substantive part. It comprises:

• information on design and development, including architecture diagrams and a description of the components;
• the complete specification of the vulnerability handling processes in place, expressly including:
  • the software bill of materials (SBOM),
  • the coordinated vulnerability disclosure policy,
  • evidence of the provision of a contact address for reporting,
  • the processes for distributing security updates;
• a description of the production and control processes.

3. Cybersecurity risk assessment

The assessment carried out under Article 13, taken into account from the design stage and throughout the life cycle, with justification for the Annex I requirements retained and ruled out.

4. Determination of the support period

The duration chosen and its justification: user expectations, nature of the product, market practice, support duration of embedded components. See Support period.

5. Standards applied

The list of harmonised standards applied in whole or in part, whose references are published in the Official Journal, and — for the parts not covered — a description of the solutions adopted to meet the essential requirements.

6. Test reports

Reports attesting the conformity of the product and of the vulnerability handling processes.

7. EU declaration of conformity

A copy of the declaration drawn up under Annex V.

8. Where applicable, notified body documents

Attestations, decisions and reports issued by the notified body involved.

Where the SBOM sits

At point 2, within the specification of the vulnerability handling processes.

The sentence to get across on the Legal side. The SBOM is not a side technical deliverable: it is a constituent part of the file that yields the CE marking. No usable SBOM → incomplete technical documentation → an ill-founded EU declaration of conformity → a legally fragile CE marking → exposed sales.

The Regulation does not require publishing the SBOM. It requires it to be in the file, held at the disposal of the authorities. Communicating it to customers is a commercial and contractual decision: see SBOM distribution.

Retention

The technical documentation and the EU declaration of conformity are kept at the disposal of market surveillance authorities for at least ten years after the product is placed on the market, or for the support period, whichever is longer.

That requires an archiving arrangement able to produce, ten years later, the exact version of the file corresponding to a given version of the product — SBOM included. See Evidence retention.

Completeness checklist

• General description, versions covered unambiguously identified
• Up-to-date architecture diagrams
• SBOM for the version concerned, machine-readable, signed
• CVD policy published, with evidence of publication
• Evidence that the contact address exists and works
• Description of the update distribution process
• Risk assessment, dated and signed, with justification for requirements ruled out
• Support period determined and justified
• List of harmonised standards applied, deviations documented
• Test reports covering the applicable requirements
• Copy of the signed EU declaration of conformity
• Where applicable, notified body attestations
• Ten-year archiving policy configured and tested

A simplified version of this file is provided for by the Commission for micro and small enterprises.