CRA technical documentation index

What this is#

A pointer layer over the technical documentation a manufacturer draws up before placing a product with digital elements on the market. One row per Annex VII element per product: the record that answers it, where that record sits, the role that owns it, and whether it is finished. Section 3.2 of CRA technical documentation and the declaration of conformity produces it. The evidence stays where it is produced; this file is what makes it findable.

How to use it#

1. Open one row per element, per product version. The elements are the eight Annex VII points, with 2(a), 2(b) and 2(c) split out ¹. See the playbook, section 3.2.
2. Name the record and its location in one cell. A location that only the producing team can open is not a location.
3. Give every row an owning role, never a person. Ownership follows the function that produces the record.
4. Set status from the closed list: 1. Complete, 2. Draft, 3. Missing or 4. Not applicable.
5. Where an element is out of scope, file the justification with it. Where an essential requirement does not apply, the documentation carries a clear justification ².
6. Fill the Declaration sheet from the signed declaration. It carries the Annex V items, with the value or the record that answers each ³.
7. Derive every retention end date. The floor is ten years after placing, or the support period if that is longer ⁴.
8. Review on the release gate, not on a calendar. The documentation is kept up to date, at least through the support period ⁵.

What good looks like#

Five of the nine Index columns, from the workbook's example rows.

Element ID	Product	Owner (role)	Status	Next review
AVII-1	Gateway firmware 4.4.3	Product manager	1. Complete	2027-05-10
AVII-2B	Gateway firmware 4.4.3	Product security lead	2. Draft	2027-02-06
AVII-3	Gateway firmware 4.4.3	Risk lead	1. Complete	2027-05-10

Fields#

Field	Required	Meaning	Common mistake
Element ID	yes	The Annex VII point the row answers	Inventing an element the annex does not name
Annex VII element	yes	The element as the annex puts it	Replacing it with an internal document title
Product	yes	The product and version the row covers	One row for a product family that shares nothing
Owner (role)	yes	The role accountable for the record	A person, or the file's custodian for every row
Record	yes	The record's name and where it sits	"In the wiki", with no path
Status	yes	1. Complete, 2. Draft, 3. Missing, 4. Not applicable	Not applicable with no justification filed
Last updated	yes	When the record changed, not the row	The date the spreadsheet was touched
Retention end	yes	Derived from placing date and support period	A general document-retention period

Download#

• File: cra-technical-documentation-index.xlsx (xlsx, 9 KB) — sheets Read first, Index, Declaration, Retention.
• Markdown variant: the same tables as _cra-technical-documentation-index.md, beside the workbook.
• Licence: CC BY 4.0 — reuse and adapt with attribution to GRCIDE.
• Version: 1.0, 2026-09-05. No personal data, no organisation names; the example rows are invented.

Related#

• Playbook: CRA technical documentation and the declaration of conformity.
• Playbook: Choosing the CRA conformity route, which decides what the module adds.
• Template: Vulnerability handling record, the records behind element 2(b).

References#

1. European Parliament and Council. Regulation (EU) 2024/2847 (Cyber Resilience Act). OJ L, 2024/2847, 20.11.2024. Articles 13 and 31 and Annexes V and VII read at https://publications.europa.eu/resource/celex/32024R2847 ⁶

Standards and certification names are the property of their respective owners. GRCIDE is an independent publication and is not affiliated with, authorized, sponsored or endorsed by any standards body.