Technical documentation
The technical documentation is the proof that a product complies. It is drawn up before the product is placed on the market, grows with every update and must be provided to market surveillance authorities on request.
Technical documentation is the full set of documents with which the manufacturer demonstrates that a product complies. Its minimum content is set out in Annex VII; it must be drawn up before the product is placed on the market and kept up to date during the support period.
Definition in the Regulation
Article 31 of Regulation (EU) 2024/2847 governs the documentation, and Annex VII its content:
- a general description of the product, with its intended purpose and the software versions relevant to security (point (1))
- a description of design, development, production and vulnerability handling, including the system architecture, software bill of materials, coordinated vulnerability disclosure policy and evidence of the contact address (point (2))
- the cybersecurity risk assessment (point (3))
- how the support period was determined (point (4))
- a list of the standards applied or, where there are none, a description of the manufacturer's own solutions (point (5))
- test and examination reports (point (6))
- a copy of the EU declaration of conformity (point (7))
Under point (8), the software bill of materials must be provided to market surveillance authorities upon a reasoned request. Under Article 31(2), the documentation must be drawn up before the product is placed on the market and updated at least during the support period. Article 13(13) requires it to be kept for at least ten years after the product has been placed on the market or for the support period, whichever is longer.
What it means for manufacturers
The documentation is where decisions are justified: which requirements of Annex I apply, why the support period is as long as it is, how updates are distributed securely. Without a harmonised standard in the Official Journal, the manufacturer has to describe its own solutions under point (5). Under Article 18(2), drawing up the documentation cannot be delegated to an authorised representative. Article 33(5) provides for a simplified form for microenterprises and small enterprises; whether the Commission has adopted it has not been verified. Under modules B and H, the notified body examines the documentation; otherwise, it stays with the manufacturer until market surveillance asks for it.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitRelated terms
- Cybersecurity risk assessment
- Software bill of materials (SBOM)
- EU declaration of conformity
- Support period