EU Declaration of Conformity: Required Fields and Structure

Annex V sets out the model structure. A declaration under the CRA contains:

1. Product identification: a number, type, batch or serial reference sufficient to identify the product with digital elements covered by the declaration.

1. Name and address: the manufacturer's name and address, and where one is appointed, those of the authorised representative.

1. Sole responsibility statement: an express statement that the declaration is issued under the sole responsibility of the manufacturer. This holds on every conformity route, including where a notified body was involved.

1. Object of the declaration: identification of the product allowing traceability, which may include a photograph where that helps.

1. Conformity statement: a statement that the object described is in conformity with the relevant Union harmonisation legislation, namely Regulation (EU) 2024/2847 and its essential cybersecurity requirements in Annex I.

1. Standards and specifications applied: references to the harmonised standards, common specifications or other technical specifications applied, with their number and version.

1. Notified body details, where applicable: the name and four-digit identification number of any notified body involved, a description of the conformity assessment procedure performed, and the certificate number.

1. Additional information: the entity the declaration is signed for and on behalf of, the place and date of issue, and the name, function and signature of the signatory.

The identification must enable unambiguous identification of what the declaration covers. For physical products this usually means the model name, model number, hardware revision and the firmware version at the time of the declaration.

For software, the declaration should cover a specific version or version range. A declaration for 'version 2.x' covering an entire line is defensible only if every version in the range genuinely meets the essential requirements the declaration asserts. Where a particular release is what brings the product into conformity, separate declarations for each conforming range are the honest approach.

Where a product has several hardware variants - different form factors or connectivity options - the declaration either covers each variant explicitly or defines its scope so that a reader can tell whether the unit in front of them falls inside it.

This section of the declaration is evidence of how conformity was demonstrated. Manufacturers should reference:

• The specific harmonised standard number and version or date, for example 'ETSI EN 303 645 V2.1.1 (2020-04)'
• Any common specifications adopted by the Commission under Article 27
• Other standards applied as supporting evidence, such as IEC 62443-4-1 or ISO/IEC 29147, noting that these do not confer presumption of conformity unless cited in the Official Journal for the CRA

Vague references such as 'applicable ETSI standards' or 'industry best practices' are inadequate. The declaration has to be specific enough for a market surveillance authority to judge whether the referenced standards cover the requirements claimed.

Where no harmonised standard has been applied - often because none is yet cited for the product category - the declaration should say what was applied instead, and the technical documentation must carry the detailed evidence. Note that a Class I product's access to internal control under Article 32(2) depends on fully applying such a standard, common specification or qualifying certification scheme, so partial application is worth stating precisely.

Where a notified body was involved, the declaration names it, gives its four-digit identification number, describes the procedure performed and quotes the certificate number. The procedures themselves are set out in Annex VIII and selected under Article 32:

• Module A, internal control: no notified body is involved, so this field records that fact.
• Module B plus Module C: EU type-examination followed by conformity to type based on internal production control.
• Module H: conformity based on full quality assurance.
• A European cybersecurity certification scheme at assurance level at least substantial, where the product's class allows or requires it.

A declaration naming a route the product's class does not permit is the most visible defect an authority can find, because it needs no technical analysis: a Class II product claiming internal control contradicts Article 32(3) on the face of the document.

The declaration is signed by a person with authority to bind the manufacturer, with their printed name and function alongside the signature, plus the place and date of issue. Electronic signatures are generally accepted under eIDAS, though national market surveillance practice is worth checking for specific products.

The declaration must be translated into the language or languages required by the Member State where the product is placed or made available.

It is then kept at the disposal of market surveillance authorities for at least ten years after the product was placed on the market, or for the support period where that is longer - the same retention rule that applies to the technical documentation. Where a change affects conformity, such as a substantial modification, a revised declaration is issued for the modified product. Version control matters: each version should state which product version it covers, and superseded versions should be archived rather than deleted, since they may be the ones covering units still in the field.

Where supplying the full declaration with every unit is impractical, the simplified form in Annex VI may accompany the product instead, carrying a short conformity statement and the internet address where this declaration can be obtained.