Chapter III - CONFORMITY OF THE PRODUCT WITH DIGITAL ELEMENTS

Article 31

Technical documentation

Regulation (EU) 2024/2847 — published 10 December 2024 · Last reviewed by Kunnus: March 2026

Quick Answer for Manufacturers

Article 31 governs the content, form, and retention of technical documentation. The concrete content is defined in Annex VII. Manufacturers must retain the documentation for 10 years after placing on the market and present it to market surveillance authorities on request.

This quick answer + FAQ supplements the original legal text with practice-oriented interpretation. Only the original text is legally binding.

(1)

The technical documentation shall contain all relevant data or details of the means used by the manufacturer to ensure that the product with digital elements and the processes put in place by the manufacturer comply with the essential cybersecurity requirements set out in Annex I. It shall at least contain the elements set out in Annex VII.

(2)

The technical documentation shall be drawn up before the product with digital elements is placed on the market and shall be continuously updated, where appropriate, at least during the support period.

(3)

For products with digital elements as referred to in Article 12, which are also subject to other Union legal acts which provide for technical documentation, a single set of technical documentation shall be drawn up containing the information referred to in Annex VII and the information required by those Union legal acts.

(4)

The technical documentation and correspondence relating to any conformity assessment procedure shall be drawn up in an official language of the Member State in which the notified body is established or in a language acceptable to that body.

(5)

The Commission is empowered to adopt delegated acts in accordance with Article 61 to supplement this Regulation by adding elements to be included in the technical documentation set out in Annex VII to take account of technological developments, as well as developments encountered in the implementation process of this Regulation. To that end, the Commission shall strive to ensure that the administrative burden on microenterprises and small and medium-sized enterprises is proportionate.

European Commission Interpretation

Guidance of 27 July 2026

The EU Commission guidance of 27 July 2026 provides official interpretation notes on this provision. Each section: summary, key takeaways, and what it means for you in practice.

Section 8.2RDPS in documentation, risk assessment and conformity assessment

RDPS must be covered in the product's risk assessment, technical documentation and conformity assessment — limited to the software modules responsible for the product's functionality and the interfaces those modules use. Downstream back-end systems the product does not directly interact with are not RDPS, but remain external dependencies whose risks must be mitigated at product level.

Key takeaways

An RDPS serving several products must be declared in each product's technical documentation — the RDPS documentation may be reused across conformity assessments.
Reusable assurance artefacts for third-party services: NIS 2 evidence (IR (EU) 2024/2690), DORA evidence, certificates under EU cybersecurity certification schemes, ISO/IEC 27001/27017.
Major changes to third-party services are not a substantial modification of the product — but manufacturers should secure information and security guarantees contractually (SLAs) and revise the risk assessment accordingly.

In practice

Create a central RDPS dossier — affected software modules, interfaces, providers used with evidence (ISO 27001/27017, NIS 2 or DORA evidence, EUCC certificates) — and reference it from every product's documentation. Anchor in provider SLAs that you are informed about major changes: they do not trigger a new conformity assessment, but they do require updating your risk assessment.

Section in the guidance overview

Browse all guidance chapters

EU Commission Guidance (C(2026) 5252 final) — The guidance reflects the European Commission's interpretation and is not legally binding. An authoritative interpretation of the EU CRA may only be given by the Court of Justice of the European Union.

Common Manufacturer Questions

How long must the technical documentation be retained?

10 years after placing the product on the market. This timeframe aligns with the liability period of the revised Product Liability Directive — retention serves PLD defense at the same time.

In which language must the documentation be?

At minimum in an official EU language accepted by the competent authorities of the relevant member state. In practice usually English or the national language.

What happens if documentation is incomplete during an audit?

The market surveillance authority can request submission within a deadline. Failure to submit or serious deficiencies can lead to fines, sales bans, or product recalls.

Related Recitals

(1)

CRA updates by email

Deadlines, official guidance, and myth-busting fact-checks on the Cyber Resilience Act — compact in our newsletter.

View newsletters

This text is reproduced from Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024. It is provided for informational purposes only and does not constitute legal advice. Only the text published in the Official Journal of the European Union is legally binding. Original text on EUR-Lex