Skip to main content
Plans: Core and Plus, and the free trial; an add-on on Starter (1 500 NOK / month, excl. VAT). Signed editions can be read and downloaded on every plan. Who: any member writes and attaches files; owners and admins sign editions and delete files permanently.
From 11 December 2027, a product with digital elements placed on the EU market needs technical documentation that shows how it meets the CRA’s essential cybersecurity requirements (CRA Art. 31, Art. 71(2)). Annex VII lists what it must contain at least. Pharus gives each product family a technical file with the Annex VII points in order, fills in what it already holds, and lets an owner or admin sign editions: each a frozen snapshot sealed by its SHA-256, with the EU declaration of conformity. You find it under Reports → Technical documentation (Annex VII).

​
The overview page

Reports → Technical documentation (Annex VII) has three parts:
  • Annex VII checklist: each point, what it asks, and its status: In Pharus, Partly in Pharus, or Written per product family below. Where Pharus holds evidence, it is listed live from your records.
  • Technical documentation per product family: each family with how many of the 10 sections are complete, its current edition, and Open. The line underneath shows how much of the workspace’s 250 MB for attachments is used.
  • SBOMs per product family: active SBOMs, components and the last SBOM per family.

​
Annex VII point by point

Open a product family to write its documentation. Each point is a card with what it asks, what Pharus already holds under In Pharus, the fields to write, and its attachments. Save each point with its own Save button; you can write the file in steps. If someone else saved the same point after you opened it, Pharus refuses the save so nobody’s text is overwritten unseen: copy your text, reload the page and apply your changes again. Each save is recorded in the audit trail.

​
What an edition needs

The family’s card shows Ready to sign or how many items are missing, and a Still missing list with links to each point. An edition can be signed once nothing is missing:
  • every field above that isn’t marked optional, including a note for each of the 14 Annex I Part I requirements;
  • an active SBOM for the family (points 2(b) and 8);
  • at least one attachment for point 6, and for point 1 when it is a hardware product;
  • a support period for the family’s current version, with an end after the start, what it is based on, and a reason if it is shorter than five years (point 4);
  • for point 7, the notified body, its number and the certificate when the procedure is EU-type examination (modules B and C) or full quality assurance (module H), and the certificate for a European cybersecurity certification scheme.

​
Attachments

Each point except 8 takes attachments: drawings, the full risk assessment, test reports, certificates.
  • Up to 4 MB per file, and 250 MB for the whole workspace.
  • Select Attach a file on the point. The file shows with who attached it and when.
  • Any member can download an attachment, also after a downgrade or while the workspace is read-only.

​
Remove or delete permanently

There are two ways to take a file away, and they do different things.
Delete permanently can’t be undone. Use it for a file that should never have been uploaded, for example one with personal data. A file that a signed edition lists can’t be deleted, because the edition hands out every file it lists.

​
Sign an edition

An edition freezes the documentation as it stands: the text of every point, the support periods, the attachments in force with their SHA-256, and what Pharus holds (the SBOMs with their hashes, the disclosure policy and contact, the counts behind the vulnerability handling record, advisories and drills). It is sealed by the SHA-256 of the whole edition and numbered from 1 per product family.
1

Check that nothing is missing

The family’s card says Ready to sign. Until then, Sign an edition is unavailable.
2

Open the dialog

Under Signed editions, select Sign an edition.
3

Give your function

Enter Your function, for example “CTO”. It is shown with your name under the declaration of conformity, and starts as your title from Settings → Your profile.
4

Sign

Select Sign. The new edition becomes the Current one.
An edition can’t be changed afterwards. For later changes, sign a new edition: it states which edition it supersedes and that edition’s SHA-256. The place of issue on the declaration is the Place of issue from point 7. Signing is recorded in the audit trail with the edition number and its hash. Members who can edit but not sign see “An owner or admin signs editions.”

​
Read, print and download an edition

Signed editions lists each edition with who signed it and their function, the date and the start of its SHA-256, and three links:
  • View and print opens the edition as a document. Select Print and choose “Save as PDF” in the browser’s print dialog for a PDF; it is named after the edition, for example “Gateway G3 · Technical documentation, edition 2”.
  • Download (.zip) downloads the whole edition.
  • Download without SBOMs leaves out the SBOM originals. The edition still lists each SBOM with its SHA-256.
The document is in English. It has a header with the organisation and its organisation number, the product family and its current version, the edition, who signed it and when, and the SHA-256; every Annex VII point in order; and the EU declaration of conformity laid out as Annex V, with “Signed for and on behalf of”, place and date of issue, name and function, and an empty signature line. Under it is the text of the simplified EU declaration of conformity (Annex VI) to ship with the product, with the address from Where the declaration is published. The declaration is in English. Make it available in the languages each Member State where the product is sold requires (Art. 28(2)).

​
What the ZIP holds

To check that an edition is unchanged, compare the SHA-256 of edition.json with the hash in Pharus and in the README:
Any member can read and download signed editions on every plan, also after a move to Starter, while the workspace is read-only, and for an archived product family.

​
Keep your editions

Keep the technical documentation and the EU declaration of conformity for at least 10 years after the product is placed on the market, or for the support period if that is longer (CRA Art. 13(13)). Pharus keeps your editions only as long as the workspace exists:
  • A closed workspace’s data is deleted 90 days after its access ends.
  • A workspace on Free that nobody signs in to for 12 months is deleted.
Owners are warned by email 30 and 7 days before the deletion, and the emails that tell owners a workspace is read-only, closed or about to be deleted list the latest signed edition of every product family with a download link. Download every edition you need and store it yourself. See Data and deletion.
Once the workspace is deleted, its signed editions and attachments are gone. Download them before access ends.

​
Who can do what

On Starter, an owner adds the technical file under Settings → Billing for 1 500 NOK / month or 15 000 NOK / year, excl. VAT. See Billing. An archived product family’s documentation can be read and downloaded, not changed, apart from deleting an attachment permanently.

Support periods

SBOMs

Board report

Data and deletion