The technical documentation referred to in Article 31 shall contain at least the following information, as applicable to the relevant product with digital elements:
How to satisfy it: Article 31 requires this file and Annex VIII Part I (2) makes drawing it up the first step of even the self-assessment route, so every conformity module terminates here. It must be kept for 10 years after placing on the market, or the support period if longer. Article 32(5) turns it into the price of avoiding a notified body: an open- source manufacturer of an Annex III product may use the ordinary Article 32(1) routes only if this documentation is public at placing.
a general description of the product with digital elements, including: (a) its intended purpose; (b) versions of software affecting compliance with essential cybersecurity requirements; (c) where the product with digital elements is a hardware product, photographs or illustrations showing external features, marking and internal layout; (d) user information and instructions as set out in Annex II;
a description of the design, development and production of the product with digital elements and vulnerability handling processes, including: (a) necessary information on the design and development of the product with digital elements, including, where applicable, drawings and schemes and a description of the system architecture explaining how software components build on or feed into each other and integrate into the overall processing; (b) necessary information and specifications of the vulnerability handling processes put in place by the manufacturer, including the software bill of materials, the coordinated vulnerability disclosure policy, evidence of the provision of a contact address for the reporting of the vulnerabilities and a description of the technical solutions chosen for the secure distribution of updates; (c) necessary information and specifications of the production and monitoring processes of the product with digital elements and the validation of those processes;
How to satisfy it: This is the ONLY place the Regulation puts the software bill of materials inside the technical file. Point (b) requires it alongside the coordinated vulnerability disclosure policy, evidence of a reporting contact address and the secure update distribution design. Annex I Part II (1) requires the SBOM to exist and be machine- readable; this is where it has to be filed.
an assessment of the cybersecurity risks against which the product with digital elements is designed, developed, produced, delivered and maintained pursuant to Article 13, including how the essential cybersecurity requirements set out in Part I of Annex I are applicable;
relevant information that was taken into account to determine the support period pursuant to Article 13(8) of the product with digital elements;
How to satisfy it: The support period is a product decision with a decade-long tail, and this point requires you to keep the reasoning that produced it, not just the date. Article 13(8) sets the duty; the minimum is five years or the expected product lifetime, whichever is longer.
a list of the harmonised standards applied in full or in part the references of which have been published in the Official Journal of the European Union, common specifications as set out in Article 27 of this Regulation or European cybersecurity certification schemes adopted pursuant to Regulation (EU) 2019/881 pursuant to Article 27(8) of this Regulation, and, where those harmonised standards, common specifications or European cybersecurity certification schemes have not been applied, descriptions of the solutions adopted to meet the essential cybersecurity requirements set out in Parts I and II of Annex I, including a list of other relevant technical specifications applied. In the event of partly applied harmonised standards, common specifications or European cybersecurity certification schemes, the technical documentation shall specify the parts which have been applied;
How to satisfy it: Where no harmonised standard is applied, this point requires a written description of the solutions adopted instead. As of 13 Aug 2026 no CRA harmonised standard is cited in the Official Journal, so in practice every technical file currently relies on this fallback rather than on the presumption of conformity, and partial application must name the parts applied.
reports of the tests carried out to verify the conformity of the product with digital elements and of the vulnerability handling processes with the applicable essential cybersecurity requirements as set out in Parts I and II of Annex I;
where applicable, the software bill of materials, further to a reasoned request from a market surveillance authority provided that it is necessary in order for that authority to be able to check compliance with the essential cybersecurity requirements set out in Annex I.
How to satisfy it: Distinct from point 2(b). This is the SBOM handed to a market surveillance authority on a reasoned request, and only where necessary to check Annex I compliance. Keeping it generable on demand is a different operational requirement from filing it once.
Every quoted requirement on this page is verbatim Official Journal text. The surrounding guidance is Legalithm’s commentary and is not regulation. This page states the obligation and its legal basis; it is not legal advice, and the corpus has not been reviewed by counsel.
