From 11 December 2027, every product with digital elements placed on the EU market needs a CE marking under the Cyber Resilience Act (Regulation (EU) 2024/2847, "CRA") - software included. For most apps, plugins, SDKs and devices, nobody checks your product before you sell it: you assess it yourself, write it down, sign a declaration and add the CE marking. This guide walks through that self-assessment, what goes in the declaration, and where a product without a box puts the CE marking.
Can you self-assess?
| Your product | Self-assessment (module A) allowed? |
|---|---|
| Default category - most apps, plugins, SDKs, games, everyday devices | Yes (Art. 32(1)) |
| Important, Class I | Only if you applied harmonised standards, common specifications or a certification scheme in full (Art. 32(2)) |
| Important, Class II, or critical | No - third-party assessment or certification (Art. 32(3) and (4)) |
| Free and open-source software in Class I or II | Yes, if the technical documentation is made public (Art. 32(5)) |
Not sure about your category? See important and critical products. Not sure the CRA applies at all? Start with the scope check.
Which products need it, and when
The CE marking under the CRA is needed for products placed on the market from 11 December 2027. A product already on the market before that date falls under the full CRA only if it is substantially modified afterwards (Art. 69(2)). For software, each new version you release after that date is a new placing on the market. For devices, it is each unit (see CRA for connected devices and firmware).
If your product already carries a CE marking under other EU law - for example the Radio Equipment Directive or the Machinery Regulation - you still need the CRA assessment, but you draw up one EU declaration of conformity covering all the acts (Art. 28(3)).
Module A in four steps
Annex VIII, Part I, describes internal control. In plain terms:
1. Meet the essential requirements. Annex I, Part I lists the product requirements: no known exploitable vulnerabilities at release, secure by default, security updates, protection of data and access, a limited attack surface, logging and secure deletion of data. Annex I, Part II lists the vulnerability handling requirements: an SBOM, fixes without delay, regular testing, a coordinated vulnerability disclosure policy, a contact address, secure and free security updates. You decide which requirements apply on the basis of your cybersecurity risk assessment (Art. 13(2)-(3)).
2. Write the technical documentation (Annex VII). This is the evidence. It must exist before you place the product on the market (Art. 13(12)):
| Annex VII point | What it contains |
|---|---|
| 1 | General description: intended purpose, software versions relevant to conformity, photos for hardware, the user information from Annex II |
| 2 | Design, development and production: architecture, how components work together, the vulnerability handling process including the SBOM, the disclosure policy, the reporting contact, how updates are distributed securely |
| 3 | The cybersecurity risk assessment and how the Annex I requirements are met |
| 4 | Information used to set the support period |
| 5 | Harmonised standards, common specifications or certification schemes applied - or, where none, a description of the solutions you chose |
| 6 | Reports of tests that verify conformity |
| 7 | A copy of the EU declaration of conformity |
| 8 | The SBOM, where a market surveillance authority asks for it with a reasoned request |
As of October 2026, no CRA harmonised standard had been cited in the Official Journal, so for most small companies point 5 means describing your own solutions. More on the SBOM and documentation in CRA SBOM and technical documentation.
3. Keep your processes in line. The manufacturer must take measures so that design, development, production and vulnerability handling keep the product compliant (Annex VIII, Part I, point 3). For series production, you need procedures so that each version or unit stays in conformity, also when the design, standards or your product change (Art. 13(14)).
4. Sign the declaration and affix the CE marking. Then keep both for 10 years after placing on the market, or for the support period if longer (Art. 13(13); Annex VIII, Part I, point 4).
What goes in the EU declaration of conformity
The declaration states that you have demonstrated that the applicable essential requirements of Annex I are met (Art. 28(1)). By signing it, you take responsibility for the product's compliance (Art. 28(4)). It must follow the model in Annex V, be kept up to date, and be translated into the language or languages required by each Member State where you sell (Art. 28(2)).
Annex V asks for eight elements. A template based on them:
EU declaration of conformity
- Product: [name, type, version or serial number - anything that identifies it uniquely]
- Manufacturer: [company name and address] (or authorised representative)
- This declaration of conformity is issued under the sole responsibility of the manufacturer.
- Object of the declaration: [identification allowing traceability; a photo may be added where appropriate]
- The object of the declaration described above is in conformity with the relevant Union harmonisation legislation: Regulation (EU) 2024/2847 [and any other act that applies]
- References to harmonised standards, common specifications or cybersecurity certifications used: [list, or "none"]
- Where applicable: notified body [name, number], procedure performed, certificate issued: [reference]
- Additional information. Signed for and on behalf of: [company]. [Place, date]. [Name, function]. [Signature]
The template is our wording of Annex V, not an official form.
The simplified declaration. You must provide a copy of the declaration with the product, but you may use a simplified version (Art. 13(20)). Annex VI gives the text: "[Name of manufacturer] declares that the product with digital elements type [designation] is in compliance with Regulation (EU) 2024/2847. The full text of the EU declaration of conformity is available at the following internet address: [URL]". For software, this fits in the about screen, the readme or the product page.
Where software puts the CE marking
For hardware, the CE marking goes visibly, legibly and indelibly on the product, or on the packaging and the declaration where that is not possible (Art. 30(1)). It may be smaller than 5 mm only if the product requires it (Art. 30(2)).
For software, Article 30(1) allows two places:
- on the EU declaration of conformity, or
- on the website accompanying the software product, in a section that is easily and directly accessible to consumers.
A practical setup for a plugin or app: a "Compliance" or "Security" page on your site with the CE marking, the full declaration, the support period end date, your disclosure policy and contact address, and a link to it from the product page and the about screen.
The CE marking must be in place before the product is placed on the market (Art. 30(3)). A notified body number follows the CE marking only where a notified body was involved in full quality assurance (Art. 30(4)) - not in module A.
The details people forget
- Identification. A type, batch or serial number, or for software a version, that lets anyone tell which product the declaration covers (Art. 13(15)).
- Your contact details. Name or trademark, postal address and an e-mail or other digital contact, on the product, its packaging or documentation (Art. 13(16)).
- Language. User information must be in a language users and authorities can easily understand (Art. 13(18)).
- If something turns out wrong. If you learn that your product does not conform, you must immediately correct it, or withdraw or recall it (Art. 13(21)).
- Updating. A new major version or a substantial modification needs an updated assessment and declaration (Art. 28(2): the declaration must be "continuously updated").
Not sure where you stand?
Take the free "Does the CRA apply to me and what must I do by December 2027" check: 8 questions, about 3 minutes, result on screen and checklist by e-mail. Take the free check
Most of a self-assessment is evidence that has to stay current: the SBOM, the vulnerability handling record, the disclosure policy. Earlybell keeps that part up to date with every release - SBOM, daily dependency checks, drafts of the 24-hour and 72-hour reports, security.txt and policy - and updates your technical documentation for December 2027. 49 EUR per product per month.
This article is based on Regulation (EU) 2024/2847 (Cyber Resilience Act). It is not legal advice. Article and annex numbers refer to that Regulation.