Samisoftz
Book a call

CRA evidence

Your CRA technical file and declaration drafts, kept current

Map each Annex I requirement to its evidence, owner and status, before 11 December 2027.

Checked against the regulation on 16 Oct 2026 · What changed

One fixed price, in writing, the same day you ask · a delivery date agreed in writing · about 4 hours of your engineers' time · the price only changes if the scope does.

NDA before anything sensitive · the drill runs on sample data · no production access · every document is yours.

One file per version · You sign the declaration · The later job, before 2027

What the CRA asks

Annex VII describes the file. The declaration and the CE marking sit with it.

This is the bigger, later job. Most teams start with reporting, which applies now, and come back to the file in 2027.

The technical documentation has to cover the Annex VII contents. The EU declaration of conformity is needed in each required language. CE marking applies. You keep the file for 10 years or the support period, whichever is longer, and you record why a requirement does not apply. No CRA harmonised standard is cited yet, so the file has to show your evidence rather than point at a standard that is not there.

The full documentation duties apply from 11 December 2027. Reporting under Article 14 does not wait for that date. Your team or your adviser decides what is enough. The tool shows the gaps.

What we build

A matrix you can keep current, and exports when market surveillance asks.

Requirements matrix

Each Annex I requirement mapped to evidence, an owner and a status.

A folder per version

Annex VII files kept per product version, so an old version still has a file.

Declaration drafts

A declaration generator with multilingual output. You sign it.

Support periods

A register of the support period you set and publish.

Exports

An export for a market surveillance request, from the file you have been keeping.

In use

When market surveillance asks for a version, you look it up. You don't spend a month collecting documents.

Market surveillance asks for a version. The matrix shows each Annex I item, the evidence, who owns it, and the reason any item does not apply. The declaration draft is in the languages that version needs.
Your adviser decides what is enough. The tool shows what is missing.

How it works

We start from the files you have, including other CE files, and extend them.

  1. Call

    What documentation exists, and for which products.

  2. Brief

    Annex I items, versions, and languages.

  3. Build

    The matrix, the folders and the declaration drafts.

  4. Launch

    One product version, with the gaps visible.

  5. Handover

    Code, docs and access are yours. We stay on call for 30 days.

What you get, and what we need

You get a file that shows its gaps. We need the products and the person who may sign.

What you get

  • Annex I mapped to evidence, owner and status.
  • Annex VII folders per version.
  • Declaration drafts in the required languages.
  • A support-period register and an export.

What we need from you

  • The products and versions in scope.
  • Existing CE or RED files we should extend.
  • Who is allowed to sign a declaration.
  • Your adviser, for the class and for what is enough.

Reporting: applies since 11 Sep 2026 · Everything else: 11 Dec 2027 · Full timeline

CRA glossary

Short definitions of Cyber Resilience Act (CRA) terms, each tied to the article or annex it comes from.

Questions

Do you sign the declaration of conformity?

No. Only the manufacturer can. We draft. You, or the person who may sign for you, sign.

Can you tell us our product class?

We can build a guided check that records your decision. Your adviser confirms it.

We already have RED or other CE files. Can you use them?

Yes. We extend what you have, rather than starting a second file that ignores the first.

Samisoftz builds the process and software your team uses to organise CRA evidence and reporting. You stay responsible for meeting the regulation. We don't give legal advice, act as a notified body, or submit reports for you.

On a delivery date agreed in writing, your team will know who decides, what to send at 24 and 72 hours, and will have practised it once on your own product. The decision to report stays with you. We set up how.

Could your team send a 24-hour early warning tomorrow? Find out in 30 minutes.

Usama, founder of Samisoftz

You'll talk to Usama, who'd build it.

30 minutes · no slides · a written answer if it's not a fit

Book a free 30-minute call

One fixed price, in writing, the same day you ask · a delivery date agreed in writing · about 4 hours of your engineers' time · the price only changes if the scope does.

NDA before anything sensitive · the drill runs on sample data · no production access · every document is yours.