CRA EU declaration of conformity generator for apps

The eight points of Annex V of the Cyber Resilience Act, filled in for one app, plus the simplified declaration of Annex VI.

Before an app is placed on the market, its manufacturer prepares the technical documentation, carries out the conformity assessment and, once compliance is demonstrated, draws up the EU declaration of conformity (Article 13(12)). By drawing it up, the manufacturer takes on responsibility for the product's compliance (Article 28(4)). Fill in the form below and get the declaration as Markdown and HTML to review, print and sign, and the short text that can go with the app instead of the full copy.

1 The app

Annex V asks for the name, the type and any additional information allowing the product to be uniquely identified.

App name Type of product Version or versions covered Identifiers (recommended)

2 The manufacturer

The company that places the app on the market under its own name, usually the client rather than the agency (see who the manufacturer is).

Manufacturer's name Manufacturer's address An authorised representative issues the declaration for the manufacturer (Annex V point 2 allows its name and address instead)

3 Object of the declaration Identification of the app allowing traceability

Leave empty to use the name, version and identifiers above. Annex V point 4 says this may include a photograph where appropriate; for an app, a screenshot of the version's About screen can serve, which is our suggestion.

4 Conformity assessment

The procedures of Article 32(1). For an important product of class I, Module A is available only where harmonised standards, common specifications or a certification scheme at assurance level at least "substantial" have been applied in full (Article 32(2)); it is not listed for class II or critical products (Article 32(3) and (4)). Check Annex III before you choose.

Internal control (Module A, Annex VIII Part I), the self-assessment route EU-type examination (Module B) followed by conformity to type based on internal production control (Module C) Full quality assurance (Module H) A European cybersecurity certification scheme (Article 27(9))

5 Standards and specifications Harmonised standards, common specifications or cybersecurity certification used (one per line)

Annex V point 6 asks for references to those in relation to which conformity is declared. Leave empty if none were applied: the declaration will say so, and your technical documentation then describes the solutions you adopted (Annex VII point 5). A working reference such as OWASP MASVS is not a harmonised standard; see the first CRA standards.

Other Union legislation the app must also declare (optional, one per line with its publication reference)

Article 28(3): where a product is subject to more than one Union legal act requiring a declaration, a single declaration is drawn up for all of them.

6 Signature Additional information (optional) Signed for and on behalf of Place of issue Date of issue Name of the signatory Function Declaration reference (optional)

Leave "on behalf of" empty to use the manufacturer's name.

Simplified declaration (optional) Internet address where the full declaration will be published

Article 13(20) lets you provide a simplified declaration with the app instead of the full copy, if it contains the exact internet address of the full one. The same address goes in point 6 of the user information page.

Load answers

What the CRA asks

Rule	What it means for an app
Content Article 28(2), Annex V	Eight points: product name, type and identification; manufacturer or authorised representative; a statement of sole responsibility; the object of the declaration for traceability; a statement of conformity with the relevant Union harmonisation legislation; the standards, common specifications or certification used; the notified body, procedure and certificate where applicable; additional information, place and date, name, function and signature.
When Article 13(12)	After the technical documentation is drawn up and the conformity assessment is done, where compliance with the essential requirements has been demonstrated. The CE marking is affixed at the same stage.
Language and updates Article 28(2)	Updated as appropriate, and made available in the languages required by the Member State where the app is placed or made available on the market.
With the app Article 13(20), Annex VI	A copy of the declaration, or a simplified declaration with the exact internet address where the full text can be read.
Retention Article 13(13)	Kept at the disposal of market surveillance authorities for at least 10 years after placing on the market, or for the support period if longer, together with the technical documentation.
Responsibility Article 28(4)	By drawing up the declaration, the manufacturer assumes responsibility for the compliance of the product. Annex V point 3 in the English Official Journal text says the declaration is issued under the sole responsibility "of the provider"; the generator names the manufacturer, who draws it up under Article 28(1).

For agencies: who signs?

The declaration is signed for the manufacturer. When an agency builds an app that the client publishes under its own name, the client is usually the manufacturer and signs; the agency prepares the evidence. The agency or client guide explains when that changes. Keep one declaration per app and update it when a new version changes what it says. Save the answers as a file to start the next version or the next client app from them.

The declaration is one of the eight parts of the technical file. The technical documentation checklist lists the others, and the Annex I checklist records the evidence behind it. The requirements apply from 11 December 2027 (Article 71(2)).

Maintaining apps for clients? Shipmark keeps the SBOM, daily vulnerability checks and the support period for every client app in one place. Founding agencies use it free until 1 April 2027.

Join the free beta

Sources

Regulation (EU) 2024/2847, Annex V: EU declaration of conformity (StreamLex).
Regulation (EU) 2024/2847, Annex VI: Simplified EU declaration of conformity (SpringLex copy of OJ L 2024/2847).
Article 28: EU declaration of conformity and the same article on StreamLex.
Article 13: paragraphs 12, 13 and 20, and Article 32: conformity assessment procedures (SpringLex copies of OJ L 2024/2847).
Regulation (EU) 2024/2847 (Cyber Resilience Act), EUR-Lex: the authentic text.

The generator runs in your browser: what you type is not sent anywhere, and nothing is stored unless you save the answers as a file on your own device. It writes a draft that follows the structure of Annex V; check it against the Official Journal and your technical documentation before anyone signs it. Not legal advice. Related: Technical documentation checklist · User information generator · Support period calculator