Meet the CRA’s decade-long custody demand.

The CRA technical file is the technical documentation set out in Annex VII. It covers the product description and intended purpose, the information and instructions for users, the design, development and vulnerability-handling processes including the software bill of materials, the cybersecurity risk assessment, the information used to set your support period, the harmonized standards applied, test reports, and a copy of your EU declaration of conformity.

CRA technical documentation must be kept for at least ten years after the product is placed on the market, or for the support period where that runs longer, under Article 13(13). The same duty covers your EU declaration of conformity. Article 31 separately requires the technical file drawn up before the product is placed on the market and kept updated across the support period.

If you cannot produce your CRA technical file, Article 58 treats technical documentation that is unavailable or incomplete as formal non-compliance, and the market surveillance authority requires you to bring that non-compliance to an end. Where it continues, the Member State restricts or prohibits the product, or has the product recalled or withdrawn from the market.

The CRA technical documentation duty applies to manufacturers first, and it reaches further down the supply chain. Article 18(3) requires an EU authorized representative to keep the technical documentation and EU declaration of conformity at the disposal of market surveillance authorities for ten years after the product is placed on the market, or the support period where that is longer, and Article 19 places a corresponding obligation on importers.

Technical File Custody is different from your own platform or cloud storage because the technical file is held by an independent third party, outside the systems that could lose it. Your own tooling can be migrated, retired, or reached by ransomware, and version history usually breaks in the move. Custody keeps each dated version intact and retrievable for the full retention period.

A technical file held in custody stays reachable through both. Custody continues independently of your company’s status, so an acquirer or successor inherits the file with its full version history rather than a partial copy. Article 13(23) separately requires a manufacturer that stops trading to inform market surveillance authorities before the cessation takes effect, and to inform users by any means available.

Technical File Custody supports the CRA most directly, covering the Annex VII technical documentation under Article 31 and the ten-year retention duty under Article 13(13). The same deposit serves the EU AI Act’s ten-year documentation keeping under Article 18, the records protection control in ISO 27001 Annex A 5.33, the six-year documentation retention HIPAA places on business associates, and the vital records expectations in the FFIEC IT Handbook.