> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pharussecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Technical documentation (Annex VII)
> Write the CRA Annex VII technical documentation per product family, sign sealed editions with the EU declaration of conformity, and download them.
**Plans:** Core and Plus, and the free trial; an add-on on Starter (1 500 NOK / month, excl. VAT). Signed editions can be read and downloaded on every plan. **Who:** any member writes and attaches files; owners and admins sign editions and delete files permanently.
From 11 December 2027, a product with digital elements placed on the EU market needs technical documentation that shows how it meets the CRA's essential cybersecurity requirements (CRA Art. 31, Art. 71(2)). Annex VII lists what it must contain at least. Pharus gives each product family a technical file with the Annex VII points in order, fills in what it already holds, and lets an owner or admin sign editions: each a frozen snapshot sealed by its SHA-256, with the EU declaration of conformity.
You find it under **Reports → Technical documentation (Annex VII)**.
## The overview page
**Reports → Technical documentation (Annex VII)** has three parts:
* **Annex VII checklist**: each point, what it asks, and its status: **In Pharus**, **Partly in Pharus**, or **Written per product family below**. Where Pharus holds evidence, it is listed live from your records.
* **Technical documentation per product family**: each family with how many of the 10 sections are complete, its current edition, and **Open**. The line underneath shows how much of the workspace's 250 MB for attachments is used.
* **SBOMs per product family**: active SBOMs, components and the last SBOM per family.
## Annex VII point by point
Open a product family to write its documentation. Each point is a card with what it asks, what Pharus already holds under **In Pharus**, the fields to write, and its attachments.
| Point | Section | What you write | What Pharus fills in |
| - | - | - | - |
| 1 | General description of the product | **Intended purpose**, **Software versions affecting compliance**, **User information and instructions (Annex II)**. Tick **Hardware product** and attach photographs or illustrations of a hardware product. | |
| 2(a) | Design and development | **Design, development and system architecture**, with drawings and schemes as attachments where they help. | |
| 2(b) | Vulnerability handling processes | **Secure distribution of updates**: signing, transport, rollback protection, automatic updates. | The family's active SBOMs; your coordinated vulnerability disclosure policy and where it is published; the contact for reporting vulnerabilities (email, web form and security.txt); the vulnerability handling record (determinations, incidents and audit trail events); CSAF advisories published. |
| 2(c) | Production and monitoring processes | **Production and monitoring processes** and **Validation of those processes**. | |
| 3 | Cybersecurity risk assessment | **Cybersecurity risk assessment** (or a summary, with the full assessment attached), and for each of the 14 essential requirements in Annex I Part I, whether it **Applies** and how it is met, or why it doesn't apply (Art. 13(4)). | |
| 4 | Support period | Nothing here: point 4 comes from the family's support periods. Select **Edit under Product families** to change them. | Each release line's period: placed on the market, when support ends, what the period is based on, and why it is shorter than five years where it is. See [Support periods](/monitoring/support-periods). |
| 5 | Standards and specifications applied | Each standard with its **Reference**, its **Kind** (harmonised standard, common specification, EU cybersecurity certification scheme, or other technical specification) and whether it was **Applied** in full or in part. Where none of the first three was applied in full, **Solutions adopted to meet Annex I**. | |
| 6 | Test reports | **Tests carried out**, and the test reports as attachments. | Drills of the vulnerability handling process completed, and the last one. |
| 7 | EU declaration of conformity | The declaration's details: **Product name and type**, **Identification and traceability**, **Manufacturer**, **Address**, **Authorised representative** (if any), **Conformity assessment procedure**, the notified body and certificate where one took part, **Other Union legislation covered**, **Additional information**, **Place of issue**, and **Where the declaration is published**. | The declaration itself, laid out as Annex V, in every signed edition. |
| 8 | SBOM on request | Nothing. | The SBOMs Pharus stores for the family, exactly as received. Annex VII point 8 asks for them only on a market surveillance authority's reasoned request. |
Save each point with its own **Save** button; you can write the file in steps. If someone else saved the same point after you opened it, Pharus refuses the save so nobody's text is overwritten unseen: copy your text, reload the page and apply your changes again. Each save is recorded in the [audit trail](/reports/audit-trail).
### What an edition needs
The family's card shows **Ready to sign** or how many items are missing, and a **Still missing** list with links to each point. An edition can be signed once nothing is missing:
* every field above that isn't marked optional, including a note for each of the 14 Annex I Part I requirements;
* an active SBOM for the family (points 2(b) and 8);
* at least one attachment for point 6, and for point 1 when it is a hardware product;
* a support period for the family's current version, with an end after the start, what it is based on, and a reason if it is shorter than five years (point 4);
* for point 7, the notified body, its number and the certificate when the procedure is EU-type examination (modules B and C) or full quality assurance (module H), and the certificate for a European cybersecurity certification scheme.
## Attachments
Each point except 8 takes attachments: drawings, the full risk assessment, test reports, certificates.
* Up to 4 MB per file, and 250 MB for the whole workspace.
* Select **Attach a file** on the point. The file shows with who attached it and when.
* Any member can download an attachment, also after a downgrade or while the workspace is read-only.
### Remove or delete permanently
There are two ways to take a file away, and they do different things.
| | **Remove** | **Delete permanently** |
| - | - | - |
| Who | Any member who can edit | Owners and admins, on every plan, also in a read-only workspace or an archived family |
| What happens | The file leaves the next edition you sign and moves to **Removed files**. A signed edition that lists it keeps it in its download. | The file and its contents are deleted for good. The audit trail keeps the file name. |
| Storage | Still counts towards the 250 MB | Stops counting |
| When | Any time | Only when no signed edition lists the file, live or removed |
**Delete permanently** can't be undone. Use it for a file that should never have been uploaded, for example one with personal data. A file that a signed edition lists can't be deleted, because the edition hands out every file it lists.
## Sign an edition
An edition freezes the documentation as it stands: the text of every point, the support periods, the attachments in force with their SHA-256, and what Pharus holds (the SBOMs with their hashes, the disclosure policy and contact, the counts behind the vulnerability handling record, advisories and drills). It is sealed by the SHA-256 of the whole edition and numbered from 1 per product family.
The family's card says **Ready to sign**. Until then, **Sign an edition** is unavailable.
Under **Signed editions**, select **Sign an edition**.
Enter **Your function**, for example "CTO". It is shown with your name under the declaration of conformity, and starts as your title from **Settings → Your profile**.
Select **Sign**. The new edition becomes the **Current** one.
An edition can't be changed afterwards. For later changes, sign a new edition: it states which edition it supersedes and that edition's SHA-256. The place of issue on the declaration is the **Place of issue** from point 7. Signing is recorded in the audit trail with the edition number and its hash.
Members who can edit but not sign see "An owner or admin signs editions."
## Read, print and download an edition
**Signed editions** lists each edition with who signed it and their function, the date and the start of its SHA-256, and three links:
* **View and print** opens the edition as a document. Select **Print** and choose "Save as PDF" in the browser's print dialog for a PDF; it is named after the edition, for example "Gateway G3 · Technical documentation, edition 2".
* **Download (.zip)** downloads the whole edition.
* **Download without SBOMs** leaves out the SBOM originals. The edition still lists each SBOM with its SHA-256.
The document is in English. It has a header with the organisation and its organisation number, the product family and its current version, the edition, who signed it and when, and the SHA-256; every Annex VII point in order; and the **EU declaration of conformity** laid out as Annex V, with "Signed for and on behalf of", place and date of issue, name and function, and an empty signature line. Under it is the text of the simplified EU declaration of conformity (Annex VI) to ship with the product, with the address from **Where the declaration is published**.
The declaration is in English. Make it available in the languages each Member State where the product is sold requires (Art. 28(2)).
### What the ZIP holds
| File | What it is |
| - | - |
| `README.txt` | What the download holds, the SHA-256 of `edition.json`, and how to check it. |
| `edition.json` | The signed edition exactly as sealed. Its SHA-256 is the edition's hash. |
| `technical-documentation.md` | The same edition as a readable document, with the EU declaration of conformity. |
| `attachments/` | The files attached to each Annex VII point when the edition was signed, one folder per point. |
| `sboms/` | The product family's SBOMs, exactly as Pharus received them. Left out by **Download without SBOMs**. |
To check that an edition is unchanged, compare the SHA-256 of `edition.json` with the hash in Pharus and in the README:
```bash macOS and Linux theme={null}
shasum -a 256 edition.json
```
```powershell Windows theme={null}
Get-FileHash edition.json
```
Any member can read and download signed editions on every plan, also after a move to Starter, while the workspace is read-only, and for an archived product family.
## Keep your editions
Keep the technical documentation and the EU declaration of conformity for at least 10 years after the product is placed on the market, or for the support period if that is longer (CRA Art. 13(13)). Pharus keeps your editions only as long as the workspace exists:
* A closed workspace's data is deleted 90 days after its access ends.
* A workspace on Free that nobody signs in to for 12 months is deleted.
Owners are warned by email 30 and 7 days before the deletion, and the emails that tell owners a workspace is read-only, closed or about to be deleted list the latest signed edition of every product family with a download link. Download every edition you need and store it yourself. See [Data and deletion](/workspace/data-and-deletion).
Once the workspace is deleted, its signed editions and attachments are gone. Download them before access ends.
## Who can do what
| Task | Who | Plans |
| - | - | - |
| Read the checklist, the documentation and signed editions | Every member | Every plan |
| Download signed editions and attachments | Every member | Every plan, also read-only |
| Write points, attach and remove files | Every member | Core and Plus, the trial, or the add-on on Starter |
| Sign an edition | Owners and admins | Core and Plus, the trial, or the add-on on Starter |
| Delete an attachment permanently | Owners and admins | Every plan, also read-only |
On Starter, an owner adds the technical file under **Settings → Billing** for 1 500 NOK / month or 15 000 NOK / year, excl. VAT. See [Billing](/workspace/billing). An archived product family's documentation can be read and downloaded, not changed, apart from deleting an attachment permanently.
## Related
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.