Who must comply with Article 28 of the Cyber Resilience Act?

Article 28 of the Cyber Resilience Act binds manufacturer.

When does Article 28 of the Cyber Resilience Act apply?

Article 28 applies from 11 December 2027.

Cyber Resilience Act · Article 28

EU declaration of conformity

Binds: manufacturer
Applies from: 11 December 2027
Evidence: document

Article 28(1): EU declaration of conformity

manufacturer · Article 28(1)

EU declaration of conformity 1. The EU declaration of conformity shall be drawn up by manufacturers in accordance with Article 13(12) and state that the fulfilment of the applicable essential cybersecurity requirements set out in Annex I has been demonstrated.

How to satisfy it: This is the artifact procurement actually asks for. The model structure is in Annex V and the required elements come from the conformity assessment procedure in Annex VIII.

Article 28(1) on EUR-Lex · as of 2026-08-13 · Regulation (EU) 2024/2847

Every quoted requirement on this page is verbatim Official Journal text. The surrounding guidance is Legalithm’s commentary and is not regulation. This page states the obligation and its legal basis; it is not legal advice, and the corpus has not been reviewed by counsel.