The Declaration of Conformity and CE marking for downloadable software

"A CE mark on software you just download from a website?" Yes — and the Cyber Resilience Act says exactly how. Before placing a product on the market, the manufacturer draws up an EU declaration of conformity (Art. 28) and affixes the CE marking (Art. 30). Let's see what that means in practice for software with no physical packaging.

The EU declaration of conformity (Art. 28)

The declaration of conformity is a document in which you declare, under your sole responsibility, that your product meets the CRA's essential requirements. It's not a certificate from an authority — it's your declaration, backed by the technical documentation (there's a separate article on that). It's drawn up before placing on the market.

What the declaration contains (Annex V)

The content isn't up to your imagination — it's set by Annex V. Eight points:

1. Name, type and information for the unique identification of the product.
2. Name and address of the manufacturer or its authorised representative.
3. A statement that it is issued under the sole responsibility of the provider.
4. The object of the declaration — identification allowing traceability (a photograph where appropriate).
5. A statement of conformity of the object with the relevant Union harmonisation legislation.
6. References to harmonised standards used or other common specifications or certification against which conformity is declared.
7. Where applicable, the name and number of the notified body, a description of the conformity assessment performed and identification of the certificate issued.
8. Additional information and signature — place and date of issue, name, function, signature.

CE marking on software (Art. 30)

For a physical product, CE is affixed visibly to the product itself, or to the packaging and the declaration. But downloadable software has no packaging — and Art. 30 anticipates this. For products in the form of software, the CE marking is affixed either to the EU declaration of conformity or on the website making the software available, with the relevant section of the website easily and directly accessible. In other words: you "attach" CE to a document or the product's page, not into the binary.

What a declaration can look like

It isn't a long document — it's more of a one-page form. Roughly like this:

1. Product: "Application XY, version 3.x" + a unique identifier.
2. Manufacturer: name, address (or an authorised representative).
3. A statement under the sole responsibility of the provider.
4. Conformity with the relevant Union harmonisation legislation (i.e. the CRA).
5. References to standards/specifications against which conformity is declared (until standards exist, you reference Annex I directly).
6. Notified body — only if applicable (for important/critical classes).
7. Place, date, name, function, signature.

For downloadable software you publish this declaration on the product's website and "attach" the CE marking to it (or to that page) — exactly as Art. 30 allows.

When it applies

This is the part of the CRA that is not imminent. The declaration of conformity and CE marking are required for products placed on the market (or substantially modified) after 11 December 2027. Until then, focus on the processes that apply earlier (reporting from 11 September 2026, an SBOM, a reporting channel) — those don't change. An overview of the dates is in the CRA timeline.

Common misconceptions

A few things people get wrong about CE and the declaration:

1. "CE is a certificate from an authority." For the default class it isn't — you issue the declaration yourself. A notified body enters only for stricter classes.
2. "Software can't be CE-marked." It can — on the declaration or on the website (Art. 30).
3. "I'll write the declaration however I like." No — the content is set by Annex V, the eight points above.
4. "It applies already." CE and the declaration attach to 11 December 2027, not 2026.

What "under sole responsibility" means

Point 3 of Annex V — a statement under the sole responsibility of the provider — is not a formality. It means you vouch for the truth of the declaration, not an authority or a notified body (for the default class). So real technical documentation must stand behind the declaration; signing conformity with no basis is exactly what fails at an inspection. The better your documentation per Annex VII, the more calmly you sign the declaration.

FAQ

1. Who signs the declaration? A person authorised to act for the manufacturer; the name, function and signature are given (Annex V point 8).
2. Where do you "attach" CE for an app? To the declaration of conformity or to the website making the software available, easily accessible (Art. 30).
3. Do we need a notified body? Not for the default class; its name and number are given only where applicable (important/critical classes).

Bottom line

A declaration of conformity and CE aren't impossible for software — the regulation anticipates products with no physical packaging. Remember three things. First, the declaration's content is set by Annex V (eight points from identification to a signature), so you don't invent it. Second, for downloadable software the CE marking goes on the declaration or on the website (Art. 30), not into the binary. Third, all of this applies only to products placed on the market after 11 December 2027 — so you have time, and the best use of that time is building the technical documentation the declaration draws directly on. A declaration under sole responsibility is only as strong as the inputs behind it. Whoever has the processes (SBOM, vulnerability handling, support-period record) running earlier doesn't start from a blank page in 2027.

Key point

A declaration of conformity and CE marking aren't impossible for software — the regulation caters to products without physical packaging. Remember three things. First, the declaration's content is set by Annex V (eight points from identification to a signature), so you don't invent it. Second, for downloadable software you place the CE marking on the declaration or on the product's website (Art. 30), not in the binary. Third, all of this applies only to products placed on the market after 11 December 2027 — so you have time, but you use it best by building, in the meantime, the technical documentation the declaration draws directly from. A declaration on sole responsibility is only as strong as the evidence behind it. Whoever has the processes (SBOM, vulnerability handling, support-period records) running earlier isn't starting from a blank page in 2027.

How CRAguard helps

CRAguard keeps the inputs the declaration of conformity draws on — the SBOM, the audit trail of the vulnerability-handling process, the support-period record — and guides the declaration's content against Annex V's eight points. When 2027 arrives, you're not starting from a blank page. Find out whether the CRA applies to you, or join the waitlist.

This article is informational and not legal advice. It is based on Regulation (EU) 2024/2847 (Art. 28, Art. 30, Annex V) and the European Commission's guidance of 27 July 2026.