Provetry
FRDEGet early access
Free check
Get early access

Provetry opens in November 2026. The free CRA check, the tools and the guides are available now.

CE marking and the EU declaration of conformity under the CRA

7 min read

On this page
  1. The order of things
  2. The EU declaration of conformity
  3. The CE marking
  4. How long to keep it
  5. Products already on the market
  6. How Provetry helps
  7. Sources

From 11 December 2027, a product with digital elements placed on the EU market must carry the CE marking, and its manufacturer must have signed an EU declaration of conformity. The two are the visible end of the Cyber Resilience Act’s process: the risk assessment, the essential requirements of Annex I, the technical documentation and the conformity assessment all lead to them.

For hardware makers, the CE marking is familiar. For software companies, it is new, and the CRA adapts it to products that have no box.

The order of things

  1. Assess the cybersecurity risks and meet the essential requirements of Annex I.
  2. Draw up the technical documentation (Annex VII).
  3. Carry out the conformity assessment that fits the product’s class: self-assessment for most, a notified body for some.
  4. Draw up and sign the EU declaration of conformity.
  5. Affix the CE marking.
  6. Keep the documentation and the declaration available to the authorities.

The EU declaration of conformity

The declaration is a short document in which the manufacturer states, under its own responsibility, that the essential requirements are met (Article 28). Annex V lists its content:

  1. The product with digital elements (name, type and any other identification)
  2. The name and address of the manufacturer or its authorised representative
  3. A statement that the declaration is issued under the sole responsibility of the provider
  4. The object of the declaration, identified so that it can be traced (a photograph may be included)
  5. A statement that the object conforms to the relevant EU harmonisation legislation
  6. References to the harmonised standards, common specifications or certifications used
  7. Where applicable, the notified body (name and number), the conformity assessment procedure followed and the certificate issued
  8. Additional information: signed for and on behalf of, place and date of issue, name and function, signature

Some practical rules:

  • One declaration for all the EU laws that apply to the product. A connected device under the CRA and the Radio Equipment Directive gets a single declaration covering both.
  • Languages: it must be translated into the language or languages required by each Member State where the product is made available.
  • Keep it up to date: a new version of the product that changes what was declared needs an updated declaration.
  • A simplified version (Annex VI) may accompany the product: one sentence saying the product complies with Regulation (EU) 2024/2847, with the internet address where the full declaration can be read.

The CE marking

The general rules of Regulation (EC) No 765/2008 apply, with CRA-specific rules on where to put it (Article 30):

  • Visibly, legibly and indelibly on the product.
  • Where that is not possible or not warranted by the nature of the product, on the packaging and in the EU declaration of conformity.
  • For software, the CE marking goes on the EU declaration of conformity or on the website accompanying the software, for example the product or download page. Linking to it from the “about” screen or the documentation helps users find it.
  • Followed by the identification number of the notified body where that body is involved in the full quality assurance procedure (module H).
  • Affixed before the product is placed on the market.

How long to keep it

The technical documentation and the EU declaration of conformity must be kept at the disposal of the market surveillance authorities for at least ten years after the product is placed on the market, or for the support period if that is longer (Article 13(13)).

Products already on the market

Products placed on the market before 11 December 2027 do not need a CRA declaration or CE marking under the CRA, unless they are substantially modified afterwards. A unit placed on the market after that date does, even if the model was launched earlier. See the CRA timeline.

How Provetry helps

Provetry’s compliance dossier (Pro and Consultant plans) gathers the technical documentation for each product, shows the conformity routes open to its class, and drafts the EU declaration of conformity from what you entered, for you to check, translate where needed and sign.

This guide is general information, not legal advice.

Sources