Annex VII Technical Documentation File

Annex VII of the Cyber Resilience Act specifies the technical documentation that every manufacturer of a product with digital elements must compile before placing the product on the market. This 'technical file' or 'technical documentation' is the primary evidence package that demonstrates the product was designed, developed, and tested in conformity with the CRA's essential requirements. Unlike user-facing documentation (Annex II) or the declaration of conformity (a short formal statement), the Annex VII file is a comprehensive internal record intended for regulatory scrutiny. It must be kept up to date throughout the product's market life and for ten years after the last unit is placed on the market.

Annex VII requires the technical file to include:

• General description: Product name, version, intended use, and supply chain description including significant third-party components.
• Design and development records: Architecture diagrams, data flow maps, design specifications, and records of security design decisions.
• Risk assessment: A documented cybersecurity risk assessment identifying threats, vulnerabilities, and mitigation measures.
• Security testing evidence: Test reports, penetration test results, code review findings, and fuzz testing outcomes.
• Standards and specifications applied: List of harmonised standards, common technical specifications, or other technical references used.
• Conformity declaration: A copy of the declaration of conformity.
• SBOM: A software bill of materials identifying all software components, their versions, and origins.
• Vulnerability handling procedures: Documentation of the CVD policy, PSIRT processes, and security advisory publication mechanism.

The Annex VII technical file must be retained for the longer of ten years after the product is placed on the market, or the entire support period of the product. Manufacturers must make the file available to national market surveillance authorities on request, typically within a defined response period (often 30 days). The file need not be submitted proactively but must be readily accessible — not stored in a way that makes rapid retrieval impractical. For products undergoing Notified Body assessment, the relevant portions of the technical file are submitted to the body as part of the assessment process. Importers and authorised representatives also have obligations to ensure the technical file is accessible to MSAs in their jurisdiction.

The Annex VII file must reflect the current state of the product. When a significant product update is released — for example a new hardware version, a major firmware release, or a change in a significant third-party component — the technical file must be updated to reflect the new design, updated risk assessment, and any new test evidence. Version control is essential: the file should clearly track which product versions are covered by which documentation versions. Manufacturers that maintain their technical file as a set of static documents created once at launch are common non-compliance targets when products evolve over time. Integrating technical file updates into the standard release management process is the recommended approach.