Chapter III - CONFORMITY OF THE PRODUCT WITH DIGITAL ELEMENTS
28

Article 28

EU declaration of conformity

Regulation (EU) 2024/2847 — published 10 December 2024 · Last reviewed by Kunnus: March 2026

(1)

The EU declaration of conformity shall be drawn up by manufacturers in accordance with Article 13(12) and state that the fulfilment of the applicable essential cybersecurity requirements set out in Annex I has been demonstrated.

(2)

The EU declaration of conformity shall have the model structure set out in Annex V and shall contain the elements specified in the relevant conformity assessment procedures set out in Annex VIII. Such a declaration shall be updated as appropriate. It shall be made available in the languages required by the Member State in which the product with digital elements is placed on the market or made available on the market.

The simplified EU declaration of conformity referred to in Article 13(20) shall have the model structure set out in Annex VI. It shall be made available in the languages required by the Member State in which the product with digital elements is placed on the market or made available on the market.

(3)

Where a product with digital elements is subject to more than one Union legal act requiring an EU declaration of conformity, a single EU declaration of conformity shall be drawn up in respect of all such Union legal acts. That declaration shall contain the identification of the Union legal acts concerned, including their publication references.

(4)

By drawing up the EU declaration of conformity, the manufacturer shall assume responsibility for the compliance of the product with digital elements.

(5)

The Commission is empowered to adopt delegated acts in accordance with Article 61 to supplement this Regulation by adding elements to the minimum content of the EU declaration of conformity set out in Annex V to take account of technological developments.

European Commission Interpretation

Guidance of 27 July 2026

The EU Commission guidance of 27 July 2026 provides official interpretation notes on this provision. Each section: summary, key takeaways, and what it means for you in practice.

Section 7.4Product families — one risk assessment, one documentation set, one declaration

Variants sharing the same architecture, security-relevant design, intended purpose and risk exposure may share a single risk assessment, technical documentation set, conformity assessment procedure and EU declaration of conformity. The sole decisive factor is whether the differences between variants are relevant to cybersecurity.

Key takeaways

  • Irrelevant: colour, form factor, memory size and other non-security-relevant characteristics.
  • Relevant: differing communication interfaces, software stacks, update mechanisms or remote connectivity — such differences must be reflected in the risk assessment and documentation.
  • The shared declaration of conformity must clearly identify the covered variants; new variants introducing new risks require an update.

In practice

Group your product variants by security-relevant differences: everything sharing architecture, interfaces and risk profile can share one risk assessment, documentation set and EU declaration of conformity — colour, form factor and memory size do not separate variants. This drastically reduces per-variant effort; the declaration must simply identify the covered variants unambiguously.

Section in the guidance overview
Browse all guidance chapters

EU Commission Guidance (C(2026) 5252 final)The guidance reflects the European Commission's interpretation and is not legally binding. An authoritative interpretation of the EU CRA may only be given by the Court of Justice of the European Union.

Related Recitals

(1)

CRA updates by email

Deadlines, official guidance, and myth-busting fact-checks on the Cyber Resilience Act — compact in our newsletter.

View newsletters

This text is reproduced from Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024. It is provided for informational purposes only and does not constitute legal advice. Only the text published in the Official Journal of the European Union is legally binding. Original text on EUR-Lex