EU declaration of conformity: the blank Annex V form

Once a conformity assessment has demonstrated compliance with the essential cybersecurity requirements, the manufacturer of a product covered by the Regulation draws up an EU declaration of conformity (Article 13(12)). Annex V sets the model structure and Article 28 says what the declaration must contain; both apply from 11 December 2027, like most of the Regulation (Article 71(2)). This form reproduces that structure, a section per element, and quotes the Regulation next to each.

Download the blank form (PDF) →

Three pages: two unbranded form pages and a page of notes with Article 28 and the Annex VI simplified declaration in full.

What Annex V requires

Eight elements, in the Regulation’s words:

1. Product. “Name and type and any additional information enabling the unique identification of the product with digital elements”
2. Manufacturer. “Name and address of the manufacturer or its authorised representative”
3. Responsibility. “A statement that the EU declaration of conformity is issued under the sole responsibility of the provider” (the Regulation’s word; Article 28(4) places that responsibility on the manufacturer)
4. Object. “Object of the declaration (identification of the product with digital elements allowing traceability, which may include a photograph, where appropriate)”
5. Conformity. “A statement that the object of the declaration described above is in conformity with the relevant Union harmonisation legislation”. One declaration covers every Union act that requires one, each named with its publication reference (Article 28(3)).
6. Standards. “References to any relevant harmonised standards used or any other common specification or cybersecurity certification in relation to which conformity is declared”
7. Notified body. “Where applicable, the name and number of the notified body, a description of the conformity assessment procedure performed and identification of the certificate issued”
8. Signature. “Additional information: Signed for and on behalf of: (place and date of issue): (name, function) (signature):”

Before you sign

• Make sure it identifies the product it is drawn up for (Annex VIII: Module A, point 4.2; Modules C and H carry the same clause) and contains the elements your conformity assessment procedure requires (Article 28(2)).
• Cite under point 6 only the standards, specifications or certifications you applied, in full or in part as the technical documentation records them (Annex VII, point 5).
• Keep it with the technical documentation for at least 10 years after the product is placed on the market or for the support period, whichever is longer (Article 13(13)), and update it as appropriate (Article 28(2)), for instance when the product or the standards it cites change (Article 13(14)).
• Provide it with the product, in full or as the Annex VI simplified declaration with the exact internet address of the full text (Article 13(20)), in the languages the Member State requires (Article 28(2)).

Where the proof comes from

Behind Annex V point 6 stands the technical documentation: the standards applied (Annex VII, point 5) and the reports of the tests carried out to verify conformity (Annex VII, point 6). We produce evidence of that kind: a technical review of the product against the Annex I requirements and a security test, each with a report written for the file. What goes into the file is the manufacturer’s decision.

Tell us about your product →

The declaration is the manufacturer’s: by drawing it up, the manufacturer assumes responsibility for the compliance of the product (Article 28(4)). We do not fill it in and take no position on whether a product is covered, which procedure applies or whether the requirements are met. General information, checked against the Regulation’s text on 13 October 2026. Article 28(5) lets the Commission add elements by delegated act; check for acts adopted after that date. Not legal advice.

Sources

• Regulation (EU) 2024/2847 (Cyber Resilience Act), OJ L, 2024/2847, 20.11.2024, http://data.europa.eu/eli/reg/2024/2847/oj: Articles 13, 28, 31 and 71; Annexes V, VI, VII and VIII. Quotations © European Union, 1998 to 2026, eur-lex.europa.eu, reused under the Commission’s reuse policy (Decision 2011/833/EU).