Skip to content
Declara
⌘K
compliance-owner

Answer a customer's supplier questionnaire

Was this page helpful?

This page reflects our reading of Cyber Resilience Act, Articles 13(8), 13(13), 13(22) and 14, Annex I Part II and Annex VII as of . It is not legal advice. Review process.

Business customers send suppliers the same six questions about the CRA. The supplier attestation answers them for one product, from what you have recorded in Declara, and says for each answer where it came from.

It is a statement by you, the manufacturer, about your product. It is not a conformity assessment, a certificate or legal advice, and Declara does not vouch for it.

Before you start

  • A Growth or Partner plan.
  • A role that can generate evidence (evidence.generate): owner, admin, member or auditor.
  • Optionally, a customer linked to the product, so the answer on exploited vulnerabilities can quote their contractual window.

Steps

  1. Open the product, then Attestation.
  2. Under Prepared for, choose a customer linked to the product, or none.
  3. Read the six answers. Each shows the question, the answer, the evidence behind it and its basis.
  4. Where an answer is wrong or incomplete, press Answer in your own words and type yours (up to 2,000 characters). It applies to this attestation only, not to the product.
  5. Press Generate the attestation. It renders in the background and appears under Generated attestations as a PDF and a JSON file, with a CSV of the answers, and a verification code.

The six statements

  1. SBOM. Whether a machine-readable SBOM exists for the supported versions, its format, and its field coverage against BSI TR-03183-2 (Annex I Part II(1)).
  2. Exploited vulnerabilities. How fast you will tell the customer. With a customer chosen, their contractual window; without one, a placeholder. It says that the window is a contract term and not an Article 14 deadline, and that you report to your CSIRT and ENISA separately under Article 14.
  3. End of support. The end date of your latest support-period determination (Art. 13(8)).
  4. Conformity route. The product class, the assessment route, how many Annex I requirements you have recorded, and whether a declaration of conformity is on record.
  5. Documentation access. That the technical documentation is kept and given to market-surveillance authorities on request (Art. 13(12)-(13), Art. 13(22), Annex VII), and that it is not shared with customers.
  6. Vulnerability handling. Your disclosure page and reporting address, your CSAF directory if you list one, and how many advisories are published (Annex I Part II).

Open alerts are deliberately not an input. An attestation that counted unresolved findings would hand a customer your triage queue.

Where each answer comes from

Every answer carries one of three labels:

  • From the manufacturer's records in Declara. Built from what you have recorded.
  • Declared by the manufacturer for this attestation. Your words, typed in step 4.
  • Still to be completed. Neither exists yet. The answer carries a visible [TODO: …] instead of a plausible sentence, the same as the generated policies.

A generated draft of the technical file or declaration with fields still to complete does not count as a finished record. The answer says what remains instead.

Verify an attestation

Each attestation has a verification code. Anyone can enter it at /verify/<code>, with no sign-in. The page confirms when it was issued and shows the SHA-256 of the JSON; the customer compares that with the hash of the JSON file you gave them. Nothing from the attestation itself is shown on that page.

What it never promises

  • That the product is compliant, certified or free of vulnerabilities. It says what you recorded and what you declared.
  • That the statements are true. You are responsible for them, and the PDF says so.
  • That a date or window you typed will be met. It is your commitment.

Attestations are a snapshot. Generating a new one does not change an earlier one, and editing an answer later does not alter what was already given to a customer.

Primary source

Regulation (EU) 2024/2847 on EUR-Lex, checked 2026-10-10:

  • Article 13(8): the support period behind the end-of-support answer.
  • Article 13(12)-(13) and 13(22): keeping the technical documentation, and giving it to a market surveillance authority on a reasoned request.
  • Article 14: the reports to the CSIRT and ENISA. A customer's contractual window is not one of them.
  • Annex I Part II: vulnerability handling, including the SBOM in point 1.
  • Annex VII: what the technical documentation contains.

Related