Answer a market-surveillance request

On a reasoned request from a market-surveillance authority, a manufacturer provides the information and documentation needed to show a product's conformity, in a language the authority easily understands. Declara collects what it holds about the product into one zip, so you are not assembling it under a deadline.

The pack is verifiable: it carries a verification code and a SHA-256 hash. It is not a conformity assessment, and it is not legal advice.

Before you start

• A Growth or Partner plan. On other plans the page says so.
• The owner or an admin role.
• The authority's request in hand: its name, their reference, the date you received it and the date they want an answer.

Steps

1. Open Evidence, then Authority requests.
2. Under Record a request, choose the product and enter the Authority, their reference, Received, Reply by and what they asked for. Press Record the request.
3. On the request, press Generate the pack. It renders in the background; the page shows its progress.
4. When it has finished, press Download the pack and check it before it leaves you.
5. Send it to the authority by the route they gave you, then press Mark as sent and record how. Drafting the answer and sending it are different acts, and the record keeps both.

What the zip holds

• The latest technical documentation and declaration text as issued. If no technical documentation was ever generated, a draft is assembled when the pack is made, with a note saying how many placeholders remain. A declaration is never drafted this way: if none was generated, declaration/NOTE.txt says so.
• Each SBOM as it was uploaded, and VEX as OpenVEX and CycloneDX VEX.
• Security advisories, the Annex I record, support-period determinations and modification decisions.
• Due-diligence reviews of the product's third-party components (Art. 13(5)), and the vulnerabilities you reported to those components' maintainers (Art. 13(6)), as records/upstream-reports.json. Practice cases are left out.
• An audit chain excerpt, and a README.txt.
• manifest.json: every file's path, SHA-256, size, source and time.

The pack's published hash is the SHA-256 of the manifest. An authority holding the zip can recompute each file's hash against the manifest, then the manifest's against the value on /verify/<code>, without trusting the zip or signing in.

The declaration you signed

If you uploaded or linked the declaration you issued on the product's Trust Center and confirmed it, the pack holds it in declaration/: the PDF as signed-declaration.pdf, or the address with the date you confirmed as signed-declaration-url.txt. A file that cannot be read back is replaced by a note saying so. With or without that confirmation, the pack also holds the declaration text Declara generated, if any; when none was generated it holds a note saying so. Signing the declaration is your act, not Declara's.

Add anything else the request covers, such as component due diligence you kept outside Declara, before sending.

What you should see

The request shows Open, then Sent once marked. The pack shows its verification code, linking to the public page, and its manifest SHA-256. A sent request keeps the pack that went out; a new pack needs a new request.

Primary source

Regulation (EU) 2024/2847 on EUR-Lex, checked 2026-10-10:

• Article 13(22): on a reasoned request, the manufacturer provides the information and documentation needed to demonstrate conformity with Annex I, and cooperates with the authority.
• Article 13(13): the technical documentation and the declaration of conformity are kept at the authorities' disposal for at least ten years or the support period, whichever is longer.
• Annex VII: what the technical documentation contains. Point 8 covers the SBOM, given on a reasoned request.

Related

• Export evidence
• Draft a product's technical file