What documents and reports does the Cyber Resilience Act require me to produce?

Article 31 requires technical documentation containing all relevant data and details of the means used to demonstrate conformity with the essential requirements, drawn up before the product is placed on the market and kept up to date.^[3]

Annex VII sets the contents, and it is broader than a design dossier. It requires:^[9]

1. A general description of the product, covering its intended purpose, the software versions affecting compliance, photographs or illustrations of external features, marking and internal layout for hardware, and the Annex II user information.
2. A description of design, development and production and of the vulnerability handling processes. This is where the software bill of materials, the coordinated vulnerability disclosure policy, evidence of a reporting contact address and a description of the secure update distribution mechanism all live.
3. An assessment of the cybersecurity risks the product is designed, developed, produced, delivered and maintained against, pursuant to Article 13.

Two consequences follow. The SBOM and the CVD policy are Annex I obligations in their own right, and they are also line items in the technical file, so producing them without filing them leaves the file incomplete. And Article 13(4) requires the risk assessment to be included here, along with a clear justification wherever an essential requirement is treated as not applicable.^[1]

Article 28 requires the manufacturer to draw up the EU declaration of conformity, stating that fulfilment of the applicable Annex I essential requirements has been demonstrated. It follows the model structure in Annex V, carries the elements specified in the relevant Annex VIII conformity assessment procedure, and is updated as appropriate.^[2]

Annex V lists what it must contain, including the name and type and any additional information uniquely identifying the product, the name and address of the manufacturer or authorised representative, a statement that the declaration is issued under sole responsibility, the object of the declaration allowing traceability, a statement of conformity with the relevant Union harmonisation legislation, and references to any harmonised standards, common specifications or cybersecurity certification relied on.^[8]

That last element is the one to watch. It records which standards you leaned on, and since no CRA harmonised standard is yet cited in the Official Journal, most declarations drawn up today will have nothing to put there. The EN 40000 timing question covers what that means for the assessment route.

Article 13(12) sequences it. Once the conformity assessment procedure has demonstrated compliance, the manufacturer draws up the declaration under Article 28 and affixes the CE marking under Article 30.^[1]

Both come from Annex I Part II, the process half of the essential requirements, and both apply regardless of what the risk assessment concludes.

Part II point (1) requires manufacturers to identify and document vulnerabilities and components contained in the product, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the product.^[6]

Two details in that wording carry weight. Machine-readable rules out a spreadsheet of component names, which points at SPDX or CycloneDX. And top-level dependencies is a floor rather than a target, so deeper transitive coverage is permitted and often necessary to answer a vulnerability question quickly.

Part II point (5) requires a policy on coordinated vulnerability disclosure to be put in place and enforced. Point (4) requires public disclosure of fixed vulnerabilities once a security update is available, including a description, information letting users identify affected products, the impacts, the severity, and clear information helping users remediate. Where a manufacturer judges the security risks of publication to outweigh the benefits, publication may be delayed in duly justified cases until users have had the chance to apply the patch.^[6]

Annex II point 2 then requires the single point of contact for vulnerability reports, and where the CVD policy can be found, to be supplied with the product.^[7]

Annex VII is held for authorities. Annex II goes to users, and the two are regularly confused.

Annex II requires the product to be accompanied, at minimum, by the manufacturer's name and contact details, the single point of contact for vulnerability reports and where the CVD policy can be found, information uniquely identifying the product, the intended purpose including the security environment provided by the manufacturer and the product's essential functionalities and security properties, any known or foreseeable circumstance related to intended use or reasonably foreseeable misuse that may lead to significant cybersecurity risks, where applicable the internet address for the EU declaration of conformity, and the type of technical security support offered with the end date of the support period.^[7]

Article 13 sets the quality bar and the retention. The information and instructions must be in a language easily understood by users and market surveillance authorities, and be clear, understandable, intelligible and legible. They are kept at the disposal of users and market surveillance authorities for at least 10 years after the product is placed on the market, or for the support period, whichever is longer.^[1]

Publishing the support period end date here is the commitment most manufacturers underestimate, because it fixes in public the date their Annex I Part II obligations stop.

Everything above is produced once and maintained. The Article 14 reports are events.

For an actively exploited vulnerability: an early warning within 24 hours, a vulnerability notification within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure is available. For a severe incident: 24 hours, 72 hours, and a final report within one month of the 72-hour notification. All filed through the ENISA single reporting platform to a coordinating CSIRT, and simultaneously accessible to ENISA.^[4]

Article 14(8) adds a communication to users, which where appropriate should be in a structured, machine-readable format that is easily automatically processable. That clause is the practical case for issuing a CSAF advisory rather than a prose bulletin.^[4][10]

The CSIRT routing and platform mechanics work through who receives these and how. Note also that where the same event engages NIS2 or GDPR, those regimes require their own separate filings on their own clocks.

The retention rules are separate obligations and they outlive the support period.

Article 13(13) requires manufacturers to keep the technical documentation and the EU declaration of conformity at the disposal of market surveillance authorities for at least 10 years after the product has been placed on the market, or for the support period, whichever is longer.^[1]

The same 10-year-or-support-period rule applies to the Annex II information and instructions, held at the disposal of users as well as authorities.^[1]

Article 13(9) runs a different clock that is easy to misread. Each security update made available during the support period must remain available after it has been issued for a minimum of 10 years, or for the remainder of the support period, whichever is longer.^[1] The clock starts when the update is issued, not when the product was placed on the market, so an update shipped in year eight of a product's life has to stay available into year eighteen.

Market surveillance authorities are the audience with a right of access, under the Chapter V powers. Notified bodies see the documentation where a third-party conformity assessment route applies. Users receive Annex II and the security updates.

Two structural features of the Regulation decide whether a document set holds up.

It has to be current. Article 31 requires the technical documentation to be kept up to date, and Article 13(3) requires the risk assessment to be documented and updated as appropriate during the support period.^[3][1] A file that reflects the product as launched, on a product that has shipped eleven releases since, is a file that no longer describes the product on the market.

It has to explain its own gaps. Article 13(4) requires a clear justification in the technical documentation wherever an essential cybersecurity requirement is not applicable.^[1] Since Annex I Part I point (2) applies its requirements only on the basis of the risk assessment and where applicable, the exclusions are as load-bearing as the inclusions, and an unexplained absence reads as an omission.^[6]

There is one form-level concession. Article 33(5) allows microenterprises and small enterprises to supply all Annex VII elements using a simplified format specified by the Commission in an implementing act, and notified bodies have to accept it. It changes the form, and the substance is unchanged.^[5]