The organisation should ensure that the technical documentation for each product with digital elements contains all relevant data to demonstrate compliance with cybersecurity requirements.

The documentation should include, as a minimum:

• A general description of the product and its intended purpose.
• Details of the design, development, and manufacturing processes.
• The cybersecurity risk assessment.
• A software bill of materials (SBOM).
• A description of the vulnerability handling process.
• Test reports and other evidence of conformity.
• The date until which the documentation will be available to authorities

The organisation should define a process for making product information and user instructions available to market surveillance authorities. This process should ensure that the documentation is provided in a clear and understandable format and is retained for at least 10 years or the support period, whichever is longer.

The organisation should compile and maintain the documentation necessary to demonstrate product conformity to market surveillance authorities. This documentation should be kept up to date and be ready to be provided upon request. Examples of relevant documentation include the cybersecurity risk assessment, software bill of materials (SBOM), and results from conformity tests.

The organisation should ensure no product with digital elements is placed on the market before the appropriate conformity assessment procedure has been completed.

In practice this means:

• Each product's classification (standard, important class I or II, or critical) determines its assessment route, with a notified body involved where third-party assessment is required.
• The applicable procedure is completed before any market release — including major new versions — and repeated whenever a product is substantially modified.
• The EU declaration of conformity is drawn up and the CE marking affixed only once conformity has been demonstrated.
• No one ships, releases or announces a product version without confirming its conformity status; uncertainty about classification or assessment status goes to the compliance owner before acting.

The organisation should act immediately and transparently when it has has reason to believe a product does not conform to the essential cybersecurity requirements.

In practice this means:

• Known or suspected non-conformities in products have placed on the market are reported immediately
• Non-conformities are never concealed, downplayed or delayed, regardless of their source.
• Corrective measures — bringing the product into conformity, withdrawal or recall — are supported as prioritised by the responsible team.
• Related records, logs and evidence are preserved intact, not deleted or altered.
• Communication with customers or authorities follows the agreed process rather than individual initiative, and requests from market surveillance authorities are met with full cooperation.

The organisation should establish and document a process for managing the technical documentation of its products with digital elements.

This process should ensure:

• Documentation is created before a product is placed on the market and is continuously updated during its support period.
• The documentation contains all data needed to demonstrate compliance with essential cybersecurity requirements.
• A single set of documentation is compiled if other EU regulations also apply.
• The documentation is in a language acceptable to the relevant conformity assessment body.

The organisation should establish a process for archiving the technical documentation and the EU declaration of conformity. These documents must be kept for at least 10 years after the product is placed on the market, or for the duration of the product's support period, whichever is longer. The archived information must be available to market surveillance authorities upon request.

The organisation should define a process for assigning unique identifiers to products with digital elements. This process ensures each product can be identified by a type, batch, or serial number. The process should also specify where the identifier is placed: directly on the product, on its packaging, or in an accompanying document. It should ensure the products themselves are marked with these identifiers.

The organisation should ensure its contact details are clearly provided for users and authorities. This information must be available on the product, its packaging, or in an accompanying document, as well as in the user instructions.

The provided details should include:

• The manufacturer's name, registered trade name, or trademark
• A postal address
• An email address or other digital contact detail
• A website, if applicable

All information must be in a language that is easily understood by users and market surveillance authorities.

The organisation should define a support period for each product with digital elements. The end date of this period, including at least the month and year, should be clearly communicated to customers at the time of purchase.

This information should be provided in an easily accessible manner, such as on the product, its packaging, or through digital means. Where technically possible, a notification should also be sent to users when the product's support period has ended.

The organisation should establish a process to ensure that every product with digital elements is accompanied by its EU declaration of conformity. The organisation can either provide a full copy of the declaration directly with the product or provide a simplified version that includes a direct internet address (URL) where the full document can be accessed.

The organisation should establish and follow a process for all products with digital elements to ensure conformity before they are placed on the market. The process should include the following steps:

• Creating the required technical documentation.
• Performing the chosen conformity assessment procedure.
• Drawing up the EU declaration of conformity after a successful assessment.
• Affixing the CE marking to the product.

The organisation should establish a procedure to ensure that mass produced products with digital elements remain compliant with regulations. This procedure should define how the organisation monitors and reacts to changes that could affect conformity, including updates to the product's design, production process, or applicable cybersecurity standards and specifications.

For important products with digital elements classified as class I, the organisation should define its conformity assessment procedure. If harmonised standards or relevant cybersecurity schemes are not fully applied, one of the following procedures must be chosen:

• EU-type examination (Module B) followed by conformity to type based on internal production control (Module C).
• Conformity assessment based on full quality assurance (Module H).

The organisation should document the chosen procedure and its implementation to ensure compliance with essential cybersecurity requirements.

The organisation should draw up a written EU declaration of conformity falling within the standard conformity model for products. This document formally declares the product has been demonstrated to meet the essential cybersecurity requirements.

One of the following procedures should be used:

• Internal control procedure (Module A)
• EU-type examination (Module B) followed by internal production control (Module C)
• Conformity assessment based on full quality assurance (Module H)
• An applicable European cybersecurity certification scheme

The organisation should establish and document its procedure for demonstrating the conformity of important products with digital elements (class II). The selected procedure must be one of the following:

• An EU type examination combined with internal production control.
• A full quality assurance system assessment.
• A European cybersecurity certification scheme at assurance level 'substantial' or higher.

The choice of procedure and the results of the assessment should be documented.

The organisation should establish a process to demonstrate that its critical products with digital elements meet the essential cybersecurity requirements. For each product classified as critical, the organisation should demonstrate conformity by either obtaining a European cybersecurity certification or using an alternative approved assessment procedure. The resulting documentation must be maintained as proof of compliance.

When a product is subject to multiple EU laws that each require a declaration of conformity, the organisation should prepare a single declaration covering all of them. This consolidated document must clearly identify all relevant legal acts and their publication references.

The organisation should establish and document a process for affixing the CE marking to its products with digital elements before they are placed on the market.

The process should define:

• Where the marking is placed: visibly, legibly, and indelibly on the product, its packaging, the accompanying EU declaration of conformity, or a dedicated website for software products.
• Cases where special risks justify the usage of a pictogram for illustrative purposes.
• How to ensure the marking is applied correctly if other EU legislation also requires a CE mark for the same product.

The size of the CE marking can be smaller than 5mm if necessary, provided it remains visible and legible.

The notified body's identification number should be included next to the CE marking if a notified body was involved in the conformity assessment. The ID should affixed by the body itself or under its instruction.

The organisation should establish a documented process for taking immediate corrective action when a product or internal process does not meet cybersecurity requirements. This process should define the criteria and steps for deciding on the appropriate measure, which could include:

• Bringing the product or process back into conformity
• Withdrawing the product from the market to prevent further distribution
• Recalling the product from end users

The organisation should provide clear and user-friendly instructions for the secure installation, operation, and use of its products to users and market surveillance authorities. The instructions must be in a language easily understood by users and remain accessible for at least 10 years or the support period, whichever is longer.

The provided information should include:

• The product's intended use and security environment.
• Guidance for secure installation, configuration, and maintenance.
• Details on the support period and how to report vulnerabilities.
• Information on how to access the software bill of materials (SBOM).

The necessary information can be provided in paper or electronic form.

The organisation should establish a process to ensure its contact information is provided with all imported products. The information must be in a language easily understood by users and market surveillance authorities and can be placed on the product, its packaging, or in an accompanying document.

The following details must be included:

• Name, registered trade name or trademark
• Postal address
• Email address or other digital contact
• Website, where applicable

The organisation should establish a clear process for actions to be taken when a marketed product is found to be non-compliant or to have a vulnerability. This process must cover how to take corrective measures, such as bringing the product into conformity, withdrawing it from the market, or initiating a recall. The procedure should also include instructions for informing the manufacturer of any vulnerabilities and for notifying market surveillance authorities in case of a significant cybersecurity risk.