--- title: "Prepare the technical file and CE marking ยท Agent Wranglers" url: https://agentwranglers.se/playbook/compliance/security-laws/cra-technical-file id: CMP-51 level: Recommended applies: digital-product region: EU updated: 2026-10-27 build: a2a6bdfed830 tokens: 746 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Prepare the technical file and CE marking For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Security laws](https://agentwranglers.se/playbook/compliance/security-laws.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. - ID: CMP-51 - Level: Recommended - Chapter: [Security laws](https://agentwranglers.se/playbook/compliance/security-laws.md) - Rule: From 11 December 2027, each covered product needs a technical file, an EU declaration of conformity and a CE marking. Keep them for ten years or the support period, whichever is longer. - Check: The release pipeline fails for a covered product when its technical file, declaration of conformity or CE marking file is missing. The storage lock on those files is at least ten years and at least the support period. - Applies when: The project sells or hands out software or devices that others run, not only a hosted service. - Region: European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds. - How: The technical file describes the product, its risk assessment, how it meets Annex I, its bill of materials and its support period. Default class products may use self-assessment. Important class II and critical products need a notified body or a certification scheme. Generate as much of the file as you can from the build, such as the bill of materials and the test reports. The component list comes from the [software bill of materials](https://agentwranglers.se/playbook/application-security/supply-chain/sbom-and-provenance.md). ## Sources - [Cyber Resilience Act Articles 28 to 31 and Annex VII](https://eur-lex.europa.eu/eli/reg/2024/2847/oj) ## Related rules - APS-75 [Publish what is in each release](https://agentwranglers.se/playbook/application-security/supply-chain/sbom-and-provenance.md) in Application security - IOT-39 [Keep a bill of materials for every firmware image](https://agentwranglers.se/playbook/connected-devices/firmware-updates/firmware-sbom.md) in Connected devices - IOT-35 [Publish the support end date for every model](https://agentwranglers.se/playbook/connected-devices/support-and-vulnerability-reports/support-end-date.md) in Connected devices **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers compliance and governance playbook`. In code you write, add a comment next to it with the same link. - Previous: [Publish an advisory for every fixed vulnerability](https://agentwranglers.se/playbook/compliance/security-laws/security-advisories.md) - [Security laws](https://agentwranglers.se/playbook/compliance/security-laws.md)