EU Declaration of Conformity (DoC)

The EU Declaration of Conformity (EU DoC) is a legally binding document in which the manufacturer takes sole responsibility for the conformity of a product with all applicable EU legislative requirements. For CRA purposes, signing the DoC is the manufacturer's formal assertion that the product meets the Annex I essential cybersecurity requirements and that the appropriate conformity assessment procedure has been completed. The DoC must be drawn up in one of the EU's official languages and must reference every applicable EU directive or regulation. It is not a certificate issued by a third party — it is a manufacturer declaration, even when a notified body has been involved in conformity assessment.

Annex V of the CRA specifies that the EU DoC must include:

1. Product identification — name, type, batch/serial number, and model number.
2. Manufacturer details — name, registered address, and contact information.
3. The declaration — a statement that the product complies with the CRA's essential requirements.
4. References to harmonised standards or common specifications applied to establish conformity.
5. The conformity assessment procedure used (Module A, B+C, H, etc.).
6. Notified body details (if a third party was involved): name, number, and certificate reference.
7. Date and place of issue.
8. Signature of an authorised person.

The DoC must also reference any other applicable EU legislation (e.g. RED, LVD, GDPR).

The manufacturer must retain the EU DoC and associated technical documentation for at least 10 years after the product is placed on the market, or for the duration of the product's support period if longer. The DoC must be updated when:

• The product is substantially modified in a way that affects its conformity with the essential requirements.
• Applicable legislation changes and the product must be reassessed.
• The notified body certificate on which the DoC relies is revised, suspended, or withdrawn.

A substantially modified product effectively requires a new conformity assessment and a new DoC. Minor security patches and bug fixes do not typically require a new DoC, but must be reflected in updated technical documentation.

For manufacturers based outside the EU, the CRA requires designation of an EU-based authorised representative. The authorised representative is the legal point of contact for market surveillance authorities within the EU and may sign the EU DoC on the manufacturer's behalf. Importers — companies that bring products from non-EU manufacturers into the EU market — must verify that the manufacturer has drawn up the technical documentation and DoC, and that the product bears a CE mark. Importers cannot affix the CE mark themselves without the underlying manufacturer documentation, and bear legal liability if they place non-compliant products on the market.