Skip to content
EU Rules Finder
English (Language)

CRA document kit: technical file, risk assessment and declarations as Word files

From 11 December 2027 every product with digital elements sold in the EU needs a technical file, a cybersecurity risk assessment and an EU declaration of conformity; reporting under Article 14 already applies. Type your company and products once; the kit writes the documents the Cyber Resilience Act lists, as Word files you can edit and keep.

Checked against the sources on 16 October 2026

Manufacturer (your company)
Authorised representative in the EU (optional)

Only if you have appointed one by written mandate (Article 18). Leave empty otherwise.

Vulnerability handling
An email address or a web form: your single point of contact (Article 13(17)). It also goes into security.txt.
A web page, for example https://example.com/security.
For example: signed firmware over HTTPS, automatic by default, users told in the app.

Products

Product 1
As marked on the product, for example R-200.
As marked on the product or its packaging, so it can be identified.
Firmware or app versions covered by these documents.
What it is for and who uses it, for example a Wi-Fi camera for homes.
What it must keep doing, and how it protects itself and its data, for example video streaming, encrypted storage, signed updates.
Operational environment, network, the data and functions an attacker could target.
Including reasonably foreseeable misuse.
For example: 7 years.
At least five years, or the expected time in use if shorter (Article 13(8)).
For example: how long users can expect to use it, and the hardware's expected life.

Not sure? The free class checker on the Cyber Resilience Act page tells you.

Leave empty if none; the file says TO COMPLETE.
Who tested, report number, date.
Name and number of the body and the certificate, if one was involved.
For example the Radio Equipment Directive 2014/53/EU.
The simplified declaration gives this address (Annex VI).
A web page with the user information and instructions, if you publish them online.
Only if you choose to share it with users.
Essential requirements (Annex I, Part I)

For each requirement: does it apply to this product, and how did you implement it, or why does it not apply? Unanswered ones are marked TO COMPLETE. The documents quote the requirements in full.

Languages of the EU declaration of conformity (your countries of sale)

Nothing you type is sent anywhere. Your business details stay in this browser for next time.

What is in the files

  • the technical documentation of each product, point by point along Annex VII;
  • the cybersecurity risk assessment of Article 13, with every essential requirement of Annex I, Part I quoted in full and your answer next to it: applies and how, or does not apply and why;
  • the EU declaration of conformity (Annex V) and the simplified declaration (Annex VI) in each language you choose, in the wording published in the Official Journal in that language;
  • the information and instructions for users that Annex II asks for, with the end of the support period as month and year;
  • for the company: a coordinated vulnerability disclosure policy, a vulnerability handling procedure along Annex I, Part II, the Article 14 reporting procedure with its deadlines, a vulnerability log, and a security.txt file for your website.

What the kit does not do

It does not decide anything for you. The category of your product and the conformity assessment procedure are your choice; the kit only offers the procedures Article 32 allows for the category you pick. Whatever you leave empty is marked TO COMPLETE. The kit never writes that a requirement is met, a test was passed or a standard applied: that is shown by your conformity assessment, and for important and critical products by a notified body.

Whether the Act covers your product and which category it is in: the free check on the Cyber Resilience Act page. Reporting an exploited vulnerability or a severe incident: the free CRA reporting register.

Nothing you type leaves your browser; the files are built on your device. Templates, not legal advice. The declarations quote the Official Journal; everything you type stays as you typed it and is not translated.

Sources