Skip to content
EU Rules Finder
English (Language)

CRA declaration of conformity: free generator in 9 languages

Under the Cyber Resilience Act every product with digital elements needs an EU declaration of conformity, drawn up by the manufacturer once the conformity assessment shows that it meets the essential requirements. Fill in your details to get the declaration and the simplified declaration in the wording the Official Journal publishes in your language. Nothing you type leaves your browser.

Checked against the sources on 2 November 2026

The name that signs the declaration.
Used in the simplified declaration.
Enough to identify the product uniquely and trace it (Annex V points 1 and 4).
Leave empty if none; the declaration then says TO COMPLETE.
Did a notified body take part in the conformity assessment?Not with internal control (module A); yes with module B and C or module H. Unanswered, point 7 says TO COMPLETE.
Article 28(3): one declaration for all acts, with their publication references, for example Directive 2014/53/EU (OJ L 153, 22.5.2014).
The simplified declaration gives this exact address (Article 13(20)).

Your declaration

EU DECLARATION OF CONFORMITY

1. Name and type and any additional information enabling the unique identification of the product with digital elements[TO COMPLETE]

2. Name and address of the manufacturer or its authorised representative[TO COMPLETE]

3. This declaration of conformity is issued under the sole responsibility of the manufacturer.

4. Object of the declaration (identification of the product with digital elements allowing traceability, which may include a photograph, where appropriate)[TO COMPLETE]

5. The object of the declaration described above is in conformity with the relevant Union harmonisation legislation:

  • Regulation (EU) 2024/2847

6. References to any relevant harmonised standards used or any other common specification or cybersecurity certification in relation to which conformity is declared[TO COMPLETE]

7. Where applicable, the name and number of the notified body, a description of the conformity assessment procedure performed and identification of the certificate issued[TO COMPLETE]

8. Additional information:

Signed for and on behalf of: [TO COMPLETE]

(place and date of issue): [TO COMPLETE], [TO COMPLETE]

(name, function) (signature): [TO COMPLETE]

SIMPLIFIED EU DECLARATION OF CONFORMITY

Hereby, … [name of manufacturer] declares that the product with digital elements type … [designation of type of product with digital element] is in compliance with Regulation (EU) 2024/2847.

The full text of the EU declaration of conformity is available at the following internet address: [TO COMPLETE]

The fixed text is the Official Journal's wording of Annexes V and VI of Regulation (EU) 2024/2847 in the language chosen; your entries stay as you typed them. Draw it up only after the conformity assessment, sign it, and keep it with the technical documentation. Not legal advice.

Every product at once, the declaration in all your languages as Word files, with the technical documentation, risk assessment and user information (paid)

What the declaration is

The declaration states that the applicable essential cybersecurity requirements of Annex I have been met (Article 28(1)). It follows the model of Annex V, is made available in the languages the Member State of sale requires and is updated as appropriate (Article 28(2)). By drawing it up, the manufacturer takes responsibility for the product's compliance (Article 28(4)).

Full or simplified declaration

With the product, give either a copy of the full declaration or the simplified declaration of Annex VI, which must contain the exact internet address of the full one (Article 13(20)). The generator writes both: publish the full declaration at the address you give.

Which procedure, and whether a notified body takes part

  • Products not listed in Annex III or IV: any procedure of Article 32(1), including internal control (module A), where no notified body takes part.
  • Important products, class I: internal control only when harmonised standards, common specifications or a certification scheme at assurance level at least 'substantial' were applied in full; otherwise EU-type examination (module B) with module C, or full quality assurance (module H) (Article 32(2)).
  • Important products, class II: module B with module C, module H, or a European cybersecurity certification scheme at assurance level at least 'substantial' (Article 32(3)).
  • Critical products (Annex IV): a European cybersecurity certification scheme under Article 8(1), or, where its conditions are not met, the class II procedures (Article 32(4)).

Not sure of the category? The free class checker on the Cyber Resilience Act page gives the class and the procedures open to it. Where a notified body took part, point 7 names it, the procedure and the certificate.

More than one EU act

A product covered by several acts that each require a declaration gets one single declaration naming all of them, with their publication references (Article 28(3)). Add them under point 5; Regulation (EU) 2024/2847 is always listed first.

Dates and keeping it

The Regulation applies from 11 December 2027; the reporting duties of Article 14 apply from 11 September 2026 and the rules on notified bodies from 11 June 2026 (Article 71(2)). Keep the declaration with the technical documentation for at least 10 years after the product is placed on the market, or for the support period if longer (Article 13(13)). Software may carry the CE marking on the declaration or on its website (Article 30(1)).

The other documents the Act asks for: the CVD policy and security.txt generator, the SBOM generator and the CRA readiness check.

Nothing you type is stored or sent: reloading the page clears it. Copy, download or print the declaration to keep it.

Sources