- Angle: the technical file belongs with the code it describes. Every protection holds documentation in the deposit, with an automated check and a vault report; the Pro levels add rebuild evidence to file with it.
- Hero mock: a vault report for the same example product as the other CRA pages. The file names are examples of what a depositor might deposit. How the vault report presents documents is an assumption: check the layout with product. The foot says the check doesn't assess content.
- Also gone: "Annex VII completeness verification" (not a confirmed feature, and Annex VII couldn't be read), "Retained until 2037", "Versions held v1.0 to v4.2 · 12 deposits", "you set how many versions to retain", the old Certified-tier seal, the fines (€10M or 2%, €5M or 1%, €15M or 2.5%; Article 64 not verified), the Article 58 corrective-measures line (not checked for this pass), the EU AI Act, ISO 27001, HIPAA and FFIEC mappings, "AES256/512" and "Setup is live in 24 hours".
- Production template error: the "With it" column on this page is headed "With Third-Party Component Escrow".
A technical file you can produce. Held with the code it describes.
The CRA asks manufacturers to keep the technical documentation and the EU declaration of conformity available to market surveillance authorities for at least ten years, or the support period if longer. Codekeeper holds your documentation in the deposit, next to the code, with an automated check of what's there.
Escrow from $199. Per application per month. Every protection holds documentation with the code.
- Trusted by 3,500+ teams
- ISO/IEC 27001:2022 certified
- Synced daily with the code
Trusted by 3,500+ teams, from regulated enterprises to fast-growing software vendors
- Annex VII isn't quoted or listed. We couldn't read it. Production's FAQ lists its contents (product description, user information, design and vulnerability handling processes "including the software bill of materials", risk assessment, support-period information, standards, test reports, declaration of conformity). Legal can add that list from the Official Journal text if they want it on the page.
What the CRA asks
A file that stays available for years.
The technical documentation is drawn up before the product reaches the market, kept current through the support period, and kept available long after.
“Manufacturers shall keep the technical documentation and the EU declaration of conformity at the disposal of the market surveillance authorities for at least 10 years after the product with digital elements has been placed on the market or for the support period, whichever is longer.”
“The technical documentation shall contain all relevant data or details of the means used by the manufacturer to ensure that the product with digital elements and the processes put in place by the manufacturer comply with the essential cybersecurity requirements set out in Annex I. It shall at least contain the elements set out in Annex VII.”
“The technical documentation shall be drawn up before the product with digital elements is placed on the market and shall be continuously updated, where appropriate, at least during the support period.”
“Manufacturers shall, upon a reasoned request from a market surveillance authority, provide that authority, in a language which can be easily understood by that authority, with all the information and documentation, in paper or electronic form, necessary to demonstrate the conformity of the product with digital elements and of the processes put in place by the manufacturer with the essential cybersecurity requirements set out in Annex I.”
Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide.
In practice
A file that has to outlast the tools it's written in.
Technical files are written in wikis, shared drives and compliance platforms, by people who move on. The duty to produce the file runs for at least ten years after the product reaches the market.
- Drawn up
- Before the product is placed on the market (Art. 13(12), 31(2))
- Kept up to date
- Continuously, where appropriate, at least during the support period (Art. 31(2))
- Contains
- At least the elements in Annex VII (Art. 31(1)), including the cybersecurity risk assessment (Art. 13(4)) and how the support period was set (Art. 13(8))
- Kept for
- At least 10 years after the product is placed on the market, or the support period if longer, with the EU declaration of conformity (Art. 13(13))
- Produced
- On a reasoned request from a market surveillance authority, in paper or electronic form (Art. 13(22))
- If you stop
- Inform market surveillance authorities and users before the cessation takes effect (Art. 13(23))
- Confirm before launch: how long earlier deposit versions are kept (already in to-confirm.md). Article 13(13) asks for at least ten years, or the support period if longer. Until product confirms, no row claims a retention period and the FAQ sends the question to a demo.
- Confirm: which document-storage integrations a technical file can sync from (production lists ShareFile and Amazon S3 among its integrations). The copy says "a connected repository or storage" and names none.
- 16 Oct: Continuity Pro added; base Continuity no longer includes Agentic Verification, so the rebuild-evidence row names Continuity Pro.
Evidence map
Evidence for each part of the duty.
What you can show a market surveillance authority or an assessor, and which protection it comes with.
| CRA | Codekeeper evidence |
|---|---|
| Art. 13(13) Technical documentation and EU declaration of conformity, at the disposal of authorities | Deposited alongside the code, with a neutral party, outside your own systems. An automated check confirms what's there. Vault reportSoftware Resilience CertificateEvery protection |
| Art. 31(2) Continuously updated during the support period | Keep the file in a connected repository or storage, and the deposit syncs daily, so it follows the version you keep current. Vault reportEvery protection |
| Art. 13(4) and 13(8) The risk assessment and how the support period was set | Deposited with the code they describe, so the documentation and the product stay together. Vault reportEvery protection |
| Art. 31(1) The means used to meet the essential requirements | Rebuild evidence to file alongside it: how the product is built, what it's built from, and proof it builds from the deposit. Build stepsSBOMRecoverability CertificateEscrow Pro · Resilience Pro · Continuity Pro |
Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide.
Choose the level
Hold the file. Add proof it builds.
Both levels hold your documentation and code with a neutral party. Escrow Pro adds dated rebuild evidence to file with them.
Escrow
From$199per application per month
Everything you need to be protected.
- Code and technical documentation held by a neutral party
- Automated check of what's deposited, with a vault report
- Software Resilience Certificate
- Release to your customers under the Escrow Agreement
Escrow Pro
From$449per application per month
Everything you need to recover.
- Everything in Escrow
- Agentic Verification: 4 rebuilds a year, on supported technology stacks
- Build steps, SBOM, Exit workbook and a deployable copy
- Recoverability Certificate
Prices for software applications; SaaS and AI have their own rows. Setup $499 per arrangement. Escrow means the deposit is released to you and you run the recovery. Resilience costs more because we do the recovery. Continuity costs more again because we also keep the live environment switched on. Resilience and Continuity hold documentation the same way. See full pricing
Sample evidence pack
See what your auditor would receive.
An anonymised set of outputs from a real Agentic Verification run, so you can judge the evidence before you talk to us.
- Recoverability Certificate
- Run report
- SBOM and Exit workbook excerpts
- Earlier versions: the answer sends the question to a demo on purpose. Replace it with the confirmed retention once product confirms it (to-confirm.md). Never promise ten years until then.
- Dates match the CRA overview. No fines answer (Article 64 not verified).
Questions
Before an authority asks for the file.
What is the technical file under the CRA?
The technical documentation in Article 31. It “shall contain all relevant data or details of the means used by the manufacturer” to meet the essential cybersecurity requirements in Annex I, and “shall at least contain the elements set out in Annex VII.” Article 13 adds that it includes the cybersecurity risk assessment and the information used to set the support period.
How long must it be kept?
For at least 10 years after the product is placed on the market, or for the support period, whichever is longer, together with the EU declaration of conformity (Article 13(13)).
Who can ask to see it?
A market surveillance authority, on a reasoned request. Article 13(22) asks manufacturers to provide all the information and documentation necessary to demonstrate conformity, in paper or electronic form, in a language the authority can easily understand.
Does Codekeeper check the file against Annex VII?
No. The automated check confirms what's deposited and lists it in a vault report. Whether the file is complete is for you and your assessor to decide.
How long do you keep earlier versions of the file?
The CRA asks for at least ten years, or the support period if longer. Ask us how earlier deposits are kept before you plan around that period. We'll go through it on a demo.
Can we keep writing the file in our own tools?
Yes. Keep it where your team works, in a repository or storage you connect, and the deposit syncs daily.
What happens if we cease operations?
Article 13(23) asks a manufacturer that ceases operations to inform market surveillance authorities and users before it takes effect. Your customers keep a route back: with Escrow, the deposit, documentation included, is released to them under the agreed conditions. With Resilience, Codekeeper runs the recovery for them.
When does this apply?
The CRA entered into force on 10 December 2024. Reporting obligations apply from 11 September 2026, and the main obligations from 11 December 2027.
Is our documentation safe with you?
Codekeeper is ISO/IEC 27001:2022 certified. Deposits are encrypted at rest with AES-256 and in transit with TLS. See the Trust Center.
Keep the technical file with the product it describes.
We'll look at where your technical documentation lives today and how it joins the deposit.