EmbedHarbor
Validate an SBOM
Regulation

CRA Annex VII technical documentation: what goes in it

The eight areas Annex VII requires in CRA technical documentation, mapped to the product evidence an IoT manufacturer can produce — and what it does not prove.

Updated 2026-11-0411 min readEnglish

The problem: You know the CRA asks for technical documentation, but the regulation points to Annex VII and the list does not map cleanly to the documents your team already has.

What Annex VII is

Article 31 of Regulation (EU) 2024/2847 requires the manufacturer to draw up technical documentation before placing a product with digital elements on the market. Annex VII sets out the minimum content, “insofar as relevant to the product”. It is a content requirement, not a template and not a certificate.

Dates

Manufacturer reporting obligations apply from 11 September 2026. The main obligations, including the technical documentation regime, apply from 11 December 2027. Products placed on the market before that date are affected when substantially modified. Confirm the current text and transition rules for your product.

The eight content areas

  1. A general description of the product: intended purpose, software versions that affect conformity, photographs or illustrations of external features, marking and internal layout for hardware, and the user information required by Annex II.
  2. A description of design, development and production, and of the vulnerability-handling procedures — including the software component architecture, the SBOM, the coordinated vulnerability disclosure policy, evidence of a contact address for vulnerability reports, and the technical solutions for securely distributing updates, plus the manufacturing and monitoring processes and their validation.
  3. The cybersecurity risk assessment considered in design, development, production, delivery and maintenance under Article 13, including how Annex I Part I applies.
  4. The information considered when determining the support period under Article 13(8).
  5. The harmonised standards, common specifications or European cybersecurity certification schemes applied — or, where none were applied, a description of the solutions used to meet Annex I Parts I and II, plus other relevant technical specifications. Partial application must state which parts.
  6. Reports of the tests and examinations carried out to verify conformity with Annex I Parts I and II, including the vulnerability-handling procedures.
  7. A copy of the EU declaration of conformity.
  8. Where applicable, the SBOM on a reasoned request from a market surveillance authority, where needed to check compliance with Annex I.

Where the SBOM fits

Point 2(b) explicitly includes the software bill of materials as part of the vulnerability-handling description, alongside the coordinated disclosure policy and the contact address for reports. Point 8 makes the SBOM available to a market surveillance authority on request. This is why an inventory that cannot be matched to advisories is a documentation problem as well as an engineering problem.

The SBOM is not the whole technical file. It supports the design description, the vulnerability process and the risk assessment, but it does not replace them, and it does not demonstrate that the product is secure.

A practical preparation order

  1. Scope the product and role first; the documentation obligations follow from them.
  2. Collect the product description, versions and user information (Annex II).
  3. Generate and validate the SBOM at build time; do not assemble it afterwards from memory.
  4. Write down the vulnerability-handling process, including the disclosure contact and the update distribution mechanism.
  5. Record the risk assessment and the support-period rationale.
  6. List the standards or solutions applied, and keep the test reports that support the claims.
  7. Keep the declaration of conformity with the file and review the whole set when the product changes.

What this guide is not

This is a summary of a regulatory content list, not legal advice and not a conformity assessment. The current regulation text and qualified review control. A generated document is preparation evidence, not certification.

Scope and limits

  • This guide summarises Annex VII; it is not legal advice and does not establish conformity.
  • The exact documentation obligations depend on the product, the risk class and the applicable conformity assessment procedure.
  • No tool can generate a complete, approved technical file from an SBOM.

Sources

Next step

Check the scope and role first

Check the scope and role first