Who must comply with Article 31 of the Cyber Resilience Act?

Article 31 of the Cyber Resilience Act binds manufacturer.

When does Article 31 of the Cyber Resilience Act apply?

Article 31 applies from 11 December 2027.

Cyber Resilience Act · Article 31

Technical documentation

Binds: manufacturer
Applies from: 11 December 2027
Evidence: document

Article 31(1): Technical documentation

manufacturer · Article 31(1)

Technical documentation 1. The technical documentation shall contain all relevant data or details of the means used by the manufacturer to ensure that the product with digital elements and the processes put in place by the manufacturer comply with the essential cybersecurity requirements set out in Annex I. It shall at least contain the elements set out in Annex VII.

How to satisfy it: Annex VII sets the minimum contents. Paragraph 2 makes it a living artifact tied to the support period, not a one-time launch deliverable.

Article 31(1) on EUR-Lex · as of 2026-08-13 · Regulation (EU) 2024/2847

Every quoted requirement on this page is verbatim Official Journal text. The surrounding guidance is Legalithm’s commentary and is not regulation. This page states the obligation and its legal basis; it is not legal advice, and the corpus has not been reviewed by counsel.