Technical Documentation (CRA)

Technical documentation is the evidentiary package that manufacturers must compile to demonstrate CRA compliance. It is not a single document but a structured collection of records that collectively demonstrate that the product was designed, tested, and is maintained in accordance with the Annex I essential requirements. Article 13(3) requires this documentation to be drawn up before market placement and kept up to date throughout the product lifecycle. The documentation is not routinely submitted to any authority — it is held by the manufacturer and produced on demand by market surveillance authorities during inspections or investigations.

Annex VI of the CRA specifies the minimum content of technical documentation:

1. General product description — purpose, function, intended use environment, and user population.
2. Design and development documentation — security architecture, threat model, attack surface analysis.
3. Information on cybersecurity risk assessment — risk methodology and results.
4. List of harmonised standards or common specifications applied.
5. SBOM — inventory of software and firmware components.
6. Vulnerability handling processes — CVD policy, patch management procedures, monitoring approach.
7. Test reports — penetration test results, vulnerability scan reports, code review findings.
8. EU Declaration of Conformity — or a reference to it.
9. Notified body documents (if applicable) — assessment certificate, module declarations.
10. Copies of security advisories issued during the product's support period.

The CRA requires technical documentation to be retained for 10 years from the date the product is placed on the market, or for the duration of the support period if longer. This means:

• A product with a 5-year support period needs documentation retained for at least 10 years.
• A product with a 12-year support period needs documentation retained for 12 years.
• Documentation must be accessible in all EU member states where the product is sold — practically this means retaining it in a format that can be shared with any national MSA.
• Non-EU manufacturers must ensure their EU authorised representative can access and provide the documentation.

Digital retention with version control and audit trail is strongly recommended.

Technical documentation is a living compliance record, not a one-time submission. It must be updated when:

• A new software version with security-relevant changes is released.
• A new vulnerability is discovered and a patch developed — the CVD record, advisory, and SBOM update must be added.
• The threat model is revised following a significant change in the threat landscape.
• A penetration test is conducted — new results replace or supplement old ones.
• The conformity assessment is updated due to a substantial product modification.

Manufacturers should establish a change management process that identifies when documentation-triggering events occur and assigns responsibility for updating the relevant documentation sections.