Technical documentation and the EU declaration, explained
For whoever signs: what these two documents are, why the law requires only one declaration for every act, which a single file can feed, how long they must be kept, and what remains your responsibility.
Two documents, not one
All the acts covered here, RED, CRA, Machinery, share the mechanics of the CE marking. The manufacturer proves conformity with a file, and states it with a declaration.
The technical documentation.
The file that demonstrates conformity: the description of the product, how each applicable essential requirement is met, and the evidence. It is not published; it is kept at the disposal of the market surveillance authorities.
The EU declaration of conformity.
The short document in which the manufacturer states that the product conforms, and lists the acts it conforms to. It is the document that gets signed.
The CE marking.
The mark affixed to the product. It comes after the other two, and is worth only what they are.
A single declaration, not one per act
Machinery Regulation 2023/1230, Annex V
A connected device falls under RED until 11.12.2027 and under the CRA afterwards; Art. 14 of the CRA, applicable from 11.09.2026, concerns it too. A connected machine falls under the Machinery Regulation and the CRA. The manufacturer does not write one declaration per act: it draws up one, which lists them all.
Annex V, Part A, point 6
The CRA says it in so many words: where a product falls under several acts that require a declaration, “a single EU declaration of conformity shall be drawn up in respect of all such Union legal acts” (Art. 28, paragraph 3).
Consolidation is therefore not a convenience euvex invents: it is in the law, and manufacturers do it by hand today, act by act, in separate documents that then have to be reconciled.
A file that lives ten years, not a document of day one
Cyber Resilience Act
Continuously updated.
The technical documentation is drawn up before placing on the market, then “continuously updated, where appropriate, at least during the support period” (Art. 31). A file that was accurate on the day of placing on the market and never touched again is not compliant, even if nobody notices.
Kept ten years.
The technical documentation and the declaration stay at the disposal of the authorities for at least ten years after placing on the market, or for the whole support period if it is longer (Art. 13, paragraph 13).
With an SBOM.
The CRA also requires identifying and documenting the product's components, including by drawing up an SBOM (Annex I, Part II, point 1). A requirement applicable from 11.12.2027.
To keep a file up to date, you have to know what changed. To know what changed, you have to keep what you knew before. That is the reason for euvex's dated history, not an ornament.
What remains yours
Annex V, Part A, point 4
The declaration is “issued under the sole responsibility of the manufacturer”. No tool carries that responsibility for you, and euvex does not claim to.
What euvex does not do
- It does not sign the declaration: you sign it.
- It does not test the product: the tests, the risk assessment and the choice of standards remain yours.
- It is not a notified body, and does not replace its involvement when an act requires it.
- It submits nothing to the CSIRT or to ENISA under Art. 14 of the CRA: it prepares the file and counts down the deadlines.
What euvex assembles
The product
One file per product and per version, because a declaration concerns a specific product, not an organisation.
The software.
The CycloneDX SBOM, the known vulnerabilities, and the dated history of every check.
The declared parts.
The CRA beyond the SBOM (risk assessment, Annexes I and II), RED and Machinery, question by question, with a printable report for each.
Reporting.
The CRA Art. 14 cases, with their three deadlines.
The declaration.
Assembled from these parts, with the reference of each act. The manufacturer's details come from your settings; what is missing is flagged, never made up.
The archive.
All revisions in one self-contained file, in standard CycloneDX: your evidence does not depend on euvex surviving.
Start with one product
Free during the beta. Create an account, declare a product, attach its SBOM. Before that, see a complete file, on a fictional product (in French).