Of all the CRA's conformity artifacts, the Declaration of Conformity is the shortest and the most consequential. It's a single document, but it's the one that legally lets a CE mark go on the product — and the one that puts a name against the claim of compliance.
What it is
The EU Declaration of Conformity (DoC) is the manufacturer's formal statement, made on its sole responsibility, that a product meets the applicable CRA requirements. It isn't a report or an assessment — it's a declaration. The assessment lives in the technical file; the DoC is the signed conclusion drawn from it, and affixing the CE marking is not permitted without one.
What it must contain
The CRA specifies the elements. A compliant declaration includes:
- Product identification sufficient for traceability — name, type, version or batch as applicable.
- Manufacturer's name and address (and authorised representative, if any).
- A statement that the declaration is issued under the manufacturer's sole responsibility.
- A statement of conformity — that the product meets the relevant CRA requirements.
- References to the standards or common specifications applied, where they were used.
- Notified body details — name, number and the certificate — where a third-party route was involved.
- Place and date of issue, and a signature on the manufacturer's behalf.
It should also make clear which CRA it declares against, and can cover other EU legislation the product is subject to, so a single declaration serves the whole CE obligation.
Who signs it, and how long to keep it
It's signed by, or on behalf of, the manufacturer — the legal person taking responsibility, not necessarily the engineer who did the work. Like the technical documentation, the DoC must be kept for at least ten years after the product is placed on the market (or the support period, if longer), and provided to a market-surveillance authority on request.
It's only as strong as its technical file
The declaration is one page. What makes it defensible is the technical file it draws its conclusion from.
A DoC is trivial to write and worthless if the file behind it doesn't support it. When an authority tests the declaration, they test the technical documentation — the risk assessment, the SBOM, the vulnerability determinations, the evidence that the essential requirements are met. Which is why the sane way to arrive at a DoC is to have been assembling that evidence all along, not to reverse-engineer it to match a declaration you've already decided to sign. The conformity pillar covers the full file; whether a notified body signs alongside you is in self-assessment vs. notified body.
Frequently asked
What is an EU Declaration of Conformity under the CRA?
A single document in which the manufacturer declares, on its sole responsibility, that a product with digital elements meets the applicable CRA requirements. Drawing it up and keeping it is a precondition for affixing the CE marking.
What must a CRA Declaration of Conformity contain?
At minimum: identification of the product allowing traceability, the manufacturer’s name and address, a statement that the declaration is issued under the manufacturer’s sole responsibility, a statement of conformity with the CRA, references to any standards or specifications applied, the details of a notified body where one was involved, and the place, date and signature.
How long must the Declaration of Conformity be kept?
For at least ten years after the product is placed on the market, or the support period, whichever is longer — the same retention as the technical documentation.