5 Information and Labeling

Compliance to the CRA demands a CE (Conformité Européenne) marking on the product and an EU Declaration of Conformity, the appointment of an authorized representative, designation of a security point‑of‑contact, and clear identification of the product. The CRA requires technical documentation that must contain:

• A cybersecurity risk assessment
• Information on the availability of security updates
• An SBOM covering top‑level dependencies
• Definitions of support and the duration of that support
• Access to revisions through a public software archive
• A user instruction set