Evidence retention
The rule
The technical documentation and the EU declaration of conformity are kept at the disposal of market surveillance authorities for at least ten years after the product is placed on the market, or for the support period, whichever is longer.
For consistency, everything the file rests on follows the same period.
What to keep
| Artefact | Why | Period |
|---|---|---|
| Technical documentation, in the version frozen at placing on the market | The centrepiece of any inspection | 10 years / support period |
| Signed EU declaration of conformity | Same | Same |
| SBOM for every shipped version, signed | File item, basis for incident response | Same |
| VEX statements and vulnerability handling log | Proof that vulnerabilities were addressed | Same |
| Security test reports | Proof of the regular-testing requirement | Same |
| Risk assessment and its revisions | Justifies the requirements ruled out | Same |
| Reporting register and platform acknowledgements | Proof of compliance with Article 14 deadlines | Same |
| Correspondence with authorities and notified bodies | Traceability of exchanges | Same |
| Notified body certificates | Basis of the assessment route | Same |
| Published security advisories | Proof of Annex I, Part II, point 4 | Same |
| Information to the user shipped | Proof of Annex II | Same |
| Public keys for verifying signatures | Without them, signatures cannot be verified | Effectively indefinite |
The guarantees to provide
| Guarantee | What it implies |
|---|---|
| Integrity | Write-once storage, or verifiable timestamped hashes |
| Timestamping | Proof of the date of existence — a signing infrastructure’s transparency log answers this well |
| Access traceability | Audit log: who consulted, who deposited, who extracted |
| Separation of duties | No one can produce, approve and modify |
| Long-term readability | Standardised formats, no dependency on a proprietary tool |
| Portability | The ability to migrate the whole set to another medium without loss |
| Indexing | Finding the file for a specific version, ten years later, within hours |
The most frequently missed point
It is neither storage nor duration: it is the ability to retrieve.
Keeping files is easy. Finding, in 2038, the exact technical documentation for version 4.2.1 placed on the market in 2028, with its SBOM, its VEX statements, its signed declaration and the key needed to verify that signature, requires an indexing chain that will have survived two platform changes and three generations of staff.
The annual retrieval exercise
It is the only control that proves anything.
Protocol:
- Draw at random a version shipped more than two years ago.
- With no preparation, ask the team to produce, within one working day: the frozen technical documentation, the signed declaration, the signed SBOM with its signature verified, the associated VEX statements, the reporting register for that product, and the user notice shipped.
- Time it, record the difficulties, fix them.
- Write a report and file it with the governance record.
A failed exercise is not an incident: it is the most useful information of the year. An exercise never run means you do not know whether the arrangement works.
Interaction with the GDPR
A ten-year retention period must remain justified against the storage limitation principle. Two precautions:
- keep in the evidence vault only what is necessary for CRA compliance — technical documentation has no business containing personal data;
- document the basis for that duration in the record of processing activities, citing the legal obligation.
Deletion
At the end of the period, deletion must be effective and logged: an audit log entry stating what was deleted, when, and on what basis. Keeping data beyond the necessary period, with no decision, is the mirror image of insufficient retention.