--- title: CRA Technical File Custody | Codekeeper description: Your CRA technical file must stay producible for 10 years, or your full support period. Codekeeper holds it in independent, versioned custody throughout. canonical_url: https://codekeeper.co/solutions/cra-technical-file-custody --- CRA Technical File Custody # Meet the CRA’s decade-long custody demand. Every product with digital elements you place on the EU market needs an Annex VII technical file, kept available to market surveillance authorities for at least ten years. Codekeeper’s Technical File Custody holds versioned files in an independent, encrypted vault. [Book a demo](https://codekeeper.co/book-a-demo) Get a sample pack Held independently — retained for the full ten years. Technical file ### Annex VII Technical File — In custody Product SentryGate Router Versions held v1.0 — v4.2 · 12 deposits Annex VII check Complete CRA EU AI Act ISO 27001 HIPAA FFIEC Retained until 2037 Ten years from market placement Version history Current v4.2 · Mar 2026 Live v3.8 · Sep 2025 Held v2.1 · Jan 2024 Held ## Join 3 500+ companies that trust Codekeeper’s immutable, encrypted vaults to hold their critical software and documentation. ![Airbus partner logo](https://codekeeper.co/hubfs/codekeeper-site/logos/partners/carousel/Airbus.svg) ![Axxiome partner logo](https://codekeeper.co/hubfs/codekeeper-site/logos/partners/carousel/Axxiome.svg) ![Bayer partner logo](https://codekeeper.co/hubfs/codekeeper-site/logos/partners/carousel/Bayer.svg) ![bat](https://codekeeper.co/hubfs/codekeeper-site/logos/partners/carousel/bat.svg) ![EU Parliament partner logo](https://codekeeper.co/hubfs/codekeeper-site/logos/partners/carousel/EU%20Parliament.svg) ![General Motors partner logo](https://codekeeper.co/hubfs/codekeeper-site/logos/partners/carousel/General%20Motors.svg) ![Gorenje partner logo](https://codekeeper.co/hubfs/codekeeper-site/logos/partners/carousel/Gorenje.svg) ![Intuit partner logo](https://codekeeper.co/hubfs/codekeeper-site/logos/partners/carousel/Intuit.svg) ![Louis Vuitton partner logo](https://codekeeper.co/hubfs/codekeeper-site/logos/partners/carousel/Louis%20Vuitton.svg) ![NASA partner logo](https://codekeeper.co/hubfs/codekeeper-site/logos/partners/carousel/NASA.svg) ![NASCAR partner logo](https://codekeeper.co/hubfs/codekeeper-site/logos/partners/carousel/Nascar.svg) ![Nestle partner logo](https://codekeeper.co/hubfs/codekeeper-site/logos/partners/carousel/Nestle.svg) ![Pepsico partner logo](https://codekeeper.co/hubfs/codekeeper-site/logos/partners/carousel/Pepsico.svg) ![Pfizer partner logo](https://codekeeper.co/hubfs/codekeeper-site/logos/partners/carousel/Pfizer.svg) ![PWC partner logo](https://codekeeper.co/hubfs/codekeeper-site/logos/partners/carousel/PwC.svg) ![Siemens partner logo](https://codekeeper.co/hubfs/codekeeper-site/logos/partners/carousel/Siemens.svg) ![Slate Digital partner logo](https://codekeeper.co/hubfs/codekeeper-site/logos/partners/carousel/Slate%20Digital.svg) ![Airbus partner logo](https://codekeeper.co/hubfs/codekeeper-site/logos/partners/logo-partner-airbus.svg) Your CE marking hinges on your technical file and EU declaration of conformity staying complete and accurate for as long as you support the product. Codekeeper holds both in an immutable vault and syncs updates to keep it current for the full retention period. ![CRA](https://codekeeper.co/hubfs/codekeeper-site/solutions/solutions-cra.svg) CRA ![EU AI Act](https://codekeeper.co/hubfs/codekeeper-site/solutions/solutions-eu-ai-act.svg) EU AI Act ![ISO 27001](https://codekeeper.co/hubfs/codekeeper-site/solutions/solutions-iso-27001.svg) ISO 27001 ![HIPAA](https://codekeeper.co/hubfs/codekeeper-site/solutions/solutions-hipaa.svg) HIPAA ![FFIEC](https://codekeeper.co/hubfs/codekeeper-site/solutions/solutions-ffiec.svg) FFIEC One custody deposit for the documentation retention requirements your industry’s frameworks place on you. The old way ## CRA retention demands outlast your storage tools. Most manufacturers assemble the technical file like any engineering document — in a wiki, object store, or a compliance platform. That works at launch, but the obligation runs a decade longer. Across that decade, platforms retire, migrations drop version history, ransomware compromises drives, and files get deleted. A technical file you cannot produce breaches your manufacturer obligations under Article 13. Fines run up to €15 million or 2.5% of worldwide annual turnover. No manufacturer can afford a migration or a breach erasing evidence they stay liable to produce. The technical file in your own tooling Annex VII technical file PDF Last edited · 14 Mar 2024 Not tested Migrated, retired, or deleted — and the version history goes with it. ![cra-sbom-escrow-team-meeting-800](https://codekeeper.co/hubfs/_sized/codekeeper-site/feature-section/cra-sbom-escrow-team-meeting-800-800x533.png) Why we built it ## The document custody system built to last decades. For 10+ years, Codekeeper has secured the technical documentation and design records of 3 500+ companies. Systems change, and documents scatter, corrupt, or get deleted. Our deposits, integrity checks, and version control are built to protect against those failures. 10+ years managing escrow 3 500+ companies protected ISO 27001 certified 24 hrs to go live ## Technical File Custody features that meet your retention needs Each capability below covers a different part of the retention duty, from keeping the file current to producing the right version years later. ### Immutable document custody Your technical file is held in an AES256/512 encrypted, immutable vault outside your own infrastructure, so ransomware, a corrupted migration, or an accidental deletion on your side leaves the deposit untouched. ### Automated deposit syncing When you update the technical file, Codekeeper pulls the new version from your connected storage and development tools, so the deposit matches the file you keep current under Article 31(2). ### Version-locked deposit history Every deposit is stored as its own dated version with a timestamped audit trail, and you set how many versions to retain. A request about a product you shipped six years ago draws the file exactly as it stood then. ### Ten-year retention, managed per product Custody runs ten years from the date each product is placed on the market, or your declared support period where that is longer — so no file leaves custody while you are still liable to produce it. ### Declaration of conformity custody Your signed EU declaration of conformity is deposited alongside the technical file version it certifies, so the two never drift apart and the pairing an authority asks for still holds years later. ### Annex VII completeness verification Verification checks each deposit against the elements Annex VII requires, so gaps are identified and corrected early instead of surfacing during an audit. How it works ## How Technical File Custody works In review AC SentryGate Router Product BL Annex VII file In custody Agreement Technical file Last deposit 2 days ago Active NV MeshLink Gateway Product FB DoC + Annex VII In custody Agreement Technical file Last deposit Today ### 1. Deposit your technical file You hand over the technical file as it stands today, including the product description, the cybersecurity risk assessment, test reports, and your signed EU declaration of conformity. Deposits 3 active · last verified today Software Resilience Certificate Software Resilience Certificate Passed ### 2. Each update logged as a dated version Codekeeper syncs changes from your systems, stores each as a dated version, and checks it against Annex VII. ![Certified tier seal](https://codekeeper.co/hubfs/codekeeper-site/assets/cert-certified.svg) Codekeeper Software Resilience Certificate Product SentryGate Router Tier Certified Annex VII check Complete · v4.2 Retained until 2037 Authorized · Codekeeper Verified ### 3. Produce the technical file on demand When a market surveillance authority or notified body asks, you retrieve the exact version they need, with its Software Resilience Certificate. Setup is live in 24 hours, and custody starts with the technical file you have today. How your team authors and stores that file stays exactly as is. [Book a demo](https://codekeeper.co/book-a-demo) ## These companies’ systems are protected, compliant, and resilient. They made the decision. They built their resilience. They have peace of mind. You can too. ![icon-google](https://codekeeper.co/hubfs/codekeeper-site/icons/ui/icon-google.svg) ![icon-g2](https://codekeeper.co/hubfs/codekeeper-site/icons/ui/icon-g2.svg) __“We’ve had a great experience with CodeKeeper. The setup process was smooth, and the team made everything very straightforward. Knowing our critical software assets are securely protected gives us real peace of mind. Their support has been responsive and professional, and the overall service has been reliable and easy to work with. Highly recommended.”__ ![testimonial-circle-j](https://codekeeper.co/hubfs/codekeeper-site/icons/testimonials/testimonial-circle-j.svg) Jordan Adler __“We worked with Codekeeper as our escrow provider for major enterprise deployments and found them to be extremely professional, responsive, and flexible throughout._ _I'd highly recommend Codekeeper. They clearly understand the realities of working with growing tech businesses and enterprise customers alike.”__ ![testimonial-circle-r](https://codekeeper.co/hubfs/codekeeper-site/icons/testimonials/testimonial-circle-r.svg) Ross Kilshaw __“I found Codekeeper's solution excellent for what I need. I scheduled a demo to better understand the possibilities. Very easy! It was a clear and straightforward meeting, focused exactly on what I needed. Excellent service!”__ ![testimonial-circle-t](https://codekeeper.co/hubfs/codekeeper-site/icons/testimonials/testimonial-circle-t.svg) Thiago Mendes ![Airbus partner logo in muted style](https://codekeeper.co/hubfs/codekeeper-site/logos/partners/muted-foreground/logo-partner-airbus-muted.svg) ![Bayer partner logo in muted style](https://codekeeper.co/hubfs/codekeeper-site/logos/partners/muted-foreground/logo-partner-bayer-muted.svg) ![EU Parliament partner logo in muted style](https://codekeeper.co/hubfs/codekeeper-site/logos/partners/muted-foreground/logo-partner-eu-parliament-muted.svg) ![General Motors partner logo in muted style](https://codekeeper.co/hubfs/codekeeper-site/logos/partners/muted-foreground/logo-partner-general-motors-muted.svg) ![Intuit partner logo in muted style](https://codekeeper.co/hubfs/codekeeper-site/logos/partners/muted-foreground/logo-partner-intuit-muted.svg) ![Nestle partner logo in muted style](https://codekeeper.co/hubfs/codekeeper-site/logos/partners/muted-foreground/logo-partner-nestle-muted.svg) ![Pepsico partner logo in muted style](https://codekeeper.co/hubfs/codekeeper-site/logos/partners/muted-foreground/logo-partner-pepsico-muted.svg) ![Pfizer partner logo in muted style](https://codekeeper.co/hubfs/codekeeper-site/logos/partners/muted-foreground/logo-partner-pfizer-muted.svg) Framework mapping ## One custody vault for all mandated retention files Several frameworks make you keep documentation and produce it years later, each with its own retention period. Those periods rarely align, leaving the same records tracked against different deadlines. Custody consolidates them onto one verified version history. ![CRA](https://codekeeper.co/hubfs/codekeeper-site/solutions/solutions-cra.svg) CRA — Art. 31 & Art. 13(13) Technical documentation and declaration of conformity, retained ten years. [![EU AI Act](https://codekeeper.co/hubfs/codekeeper-site/solutions/solutions-eu-ai-act.svg) EU AI Act — Art. 11 & Art. 18 Technical documentation kept available to national competent authorities for ten years.](https://codekeeper.co/solutions/eu-ai-act) [![ISO 27001](https://codekeeper.co/hubfs/codekeeper-site/solutions/solutions-iso-27001.svg) ISO 27001 — Annex A 5.33 Records protected from loss, destruction, and falsification, in line with retention requirements.](https://codekeeper.co/solutions/iso-27001-evidence-pack) ![HIPAA](https://codekeeper.co/hubfs/codekeeper-site/solutions/solutions-hipaa.svg) HIPAA — 45 CFR §164.316(b)(2)(i) Documentation retained six years, binding on business associates. [![FFIEC](https://codekeeper.co/hubfs/codekeeper-site/solutions/solutions-ffiec.svg) FFIEC — BCM booklet Vital records kept current and version-controlled for retrieval.](https://codekeeper.co/solutions/ffiec-evidence-pack) What's at stake ## Your EU market success comes down to one file ### Without it * Product pulled from the market. Unavailable or incomplete documentation is formal non-compliance under Article 58 — the product can be restricted, recalled, or withdrawn. * Fines up to €10M or 2% of worldwide annual turnover for a deficient technical file or declaration of conformity. * A further €5M or 1% for supplying an incomplete file to a market surveillance authority. * Total version history loss if a platform is retired or acquired, leaving you with the compliance ramifications with no way out. €15M or 2.5% of worldwide annual turnover — the ceiling for breaching your Article 13 manufacturer obligations ### With Third-Party Component Escrow * The file is held outside your infrastructure — an outage, ransomware, or a migration leaves it untouched. * Every dated version stays retrievable — a request about a six-year-old product draws the version that shipped with it. * Retention runs to each product’s deadline — covering the full ten years from placement or the support period, whichever is longer. * Verified against Annex VII requirements — ensuring it holds what’s required and issues a Software Resilience Certificate as proof. * File version history stays intact — meeting the compliance obligations even if you stop trading or are acquired. [Book a demo](https://codekeeper.co/book-a-demo) Sample ## See a technical file custody report A standalone Software Resilience Report showing each deposited version of a technical file with its timestamp, the changes recorded against it, and the Annex VII completeness check behind them. Version timeline Change log ![Certified tier seal](https://codekeeper.co/hubfs/codekeeper-site/assets/cert-certified.svg) Codekeeper Software Resilience Report Product SentryGate Router Tier Certified Annex VII check Complete · v4.2 Retained until 2037 Versions held 18 · since 2027 Integrity checks All passed Authorized · Codekeeper Verified Get the sample custody report We’ll email the sample custody report to you. ## Give your CRA technical file a permanent keeper. Ten years is several corporate lifetimes — the engineers and compliance leads who wrote the risk assessment and shipped each version can move on at any time. Codekeeper holds the technical file independently and tracks its full version history, so you can always point to the version market surveillance authorities want to see. [Book a demo](https://codekeeper.co/book-a-demo) Get a sample pack Frequently asked questions ## Good questions to ask first. What counts as the CRA technical file? The CRA technical file is the technical documentation set out in Annex VII. It covers the product description and intended purpose, the information and instructions for users, the design, development and vulnerability-handling processes including [the software bill of materials](https://codekeeper.co/solutions/cra-sbom-escrow) , the cybersecurity risk assessment, the information used to set [your support period](https://codekeeper.co/solutions/cra-support-period-custody) , the harmonized standards applied, test reports, and a copy of your EU declaration of conformity. How long must CRA technical documentation be kept? CRA technical documentation must be kept for at least ten years after the product is placed on the market, or for the support period where that runs longer, under Article 13(13). The same duty covers your EU declaration of conformity. Article 31 separately requires the technical file drawn up before the product is placed on the market and kept updated across the support period. What happens if you cannot produce your CRA technical file? If you cannot produce your CRA technical file, Article 58 treats technical documentation that is unavailable or incomplete as formal non-compliance, and the market surveillance authority requires you to bring that non-compliance to an end. Where it continues, the Member State restricts or prohibits the product, or has the product recalled or withdrawn from the market. Who does the CRA technical documentation duty apply to? The CRA technical documentation duty applies to manufacturers first, and it reaches further down the supply chain. Article 18(3) requires an EU authorized representative to keep the technical documentation and EU declaration of conformity at the disposal of market surveillance authorities for ten years after the product is placed on the market, or the support period where that is longer, and Article 19 places a corresponding obligation on importers. How is Technical File Custody different from keeping the technical file in our own compliance platform or cloud storage? Technical File Custody is different from your own platform or cloud storage because the technical file is held by an independent third party, outside the systems that could lose it. Your own tooling can be migrated, retired, or reached by ransomware, and version history usually breaks in the move. Custody keeps each dated version intact and retrievable for the full retention period. What happens to the technical file if we cease operations or are acquired? A technical file held in custody stays reachable through both. Custody continues independently of your company’s status, so an acquirer or successor inherits the file with its full version history rather than a partial copy. Article 13(23) separately requires a manufacturer that stops trading to inform market surveillance authorities before the cessation takes effect, and to inform users by any means available. Which regulations does Technical File Custody support? Technical File Custody supports the CRA most directly, covering the Annex VII technical documentation under Article 31 and the ten-year retention duty under Article 13(13). The same deposit serves [the EU AI Act’s ten-year documentation keeping under Article 18](https://codekeeper.co/solutions/eu-ai-act) , the [records protection control in ISO 27001 Annex A 5.33](https://codekeeper.co/solutions/iso-27001-evidence-pack) , the six-year documentation retention HIPAA places on business associates, and the [vital records expectations in the FFIEC IT Handbook](https://codekeeper.co/solutions/ffiec-evidence-pack) . [More answers in the FAQ →](https://codekeeper.co/faq)