Under the EU Cyber Resilience Act, a manufacturer needs technical documentation (Annex VII), user information (Annex II), an EU declaration of conformity (Annex V) and vulnerability handling records. The documentation and declaration must be kept for at least 10 years after market placement or for the support period, whichever is longer.
What does the regulation say about dates?
Regulation (EU) 2024/2847 says it applies from 11 December 2027. Two parts apply earlier: Article 14, the manufacturer reporting obligations, from 11 September 2026, and Chapter IV on notification of conformity assessment bodies from 11 June 2026. Because Article 14 date has passed, reporting readiness is the first thing to check.
What goes in the technical documentation?
Annex VII sets out what the file must contain, as applicable to the product. Read as a checklist:
- A general description: intended purpose, software versions affecting compliance, and the user information from Annex II. For hardware, photographs or illustrations of external features and internal layout.
- Design, development and production: system architecture showing how software components build on and feed into each other, plus the specification of vulnerability handling processes. Annex VII names the software bill of materials, the coordinated vulnerability disclosure policy, evidence of a contact address for vulnerability reports, and the technical solutions chosen for secure distribution of updates.
- A cybersecurity risk assessment covering how the Annex I essential requirements apply.
- The information used to determine the support period.
- A list of harmonised standards, common specifications or certification schemes applied, in full or in part. If you did not apply them, describe the solutions you used instead.
- Test reports that verify conformity and the vulnerability handling processes.
The list continues past these items, so read Annex VII itself against your product before you finish a file.
What must users be told?
Annex II lists the minimum information and instructions that accompany the product. It includes manufacturer contact details, the single point of contact for vulnerability reports and where to find the disclosure policy, product identification, the intended purpose and security environment, known risky circumstances, the type of security support and the end date of the support period, and instructions for secure commissioning, updates and decommissioning. If you choose to make the SBOM available to users, Annex II asks you to say where.
How do the reporting steps work?
Article 14 asks the manufacturer to notify an actively exploited vulnerability to the designated CSIRT and ENISA through the single reporting platform. The steps are an early warning within 24 hours of becoming aware, a vulnerability notification within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure is available. Records that prove when you became aware, who decided and when each notification went out are the evidence an authority will look for.
A constructed example: a firmware vendor learns on a Tuesday that a flaw in its camera is exploited. Its evidence file should show the time of awareness, the early warning timestamp, the 72-hour notice, the fix release record and the final report. If any of those lives only in a chat thread, the file is weak.
How do you keep the evidence usable?
Documentation is only evidence if it matches the shipped product. Tie the SBOM to each release, store signed release records and keep the risk assessment dated and versioned. Safeguard's SBOM generation and dependency scanning can produce component inventories per build, which feeds item 2 of the file. The regulation text decides what is required, so check your product class and conformity assessment route separately.
What to do
- Create one documentation file per product and version, using the Annex VII headings.
- Draft the Annex II user information and publish the vulnerability contact and disclosure policy.
- Produce an SBOM for every release and store it with the release record.
- Write the Article 14 reporting runbook and rehearse the 24 hour, 72 hour and 14 day steps.
- Record the support period decision and the information behind it.
- Set a retention rule of at least 10 years or the support period, whichever is longer.
- Confirm your conformity assessment route for your product class with the regulation and the authorities.
Quick check
How long must the documentation be kept?
At least 10 years after the product is placed on the market, or for the support period if that is longer, per Article 13 and Annex VIII.
Is an SBOM mandatory to publish?
Annex VII requires the SBOM in the technical documentation. Annex II only asks you to say where users can find it if you decide to make it available to them.
Sources
Last reviewed: 18 October 2026.
