Build an EU Declaration of Conformity

The CRA's Annex V requires a signed Declaration of Conformity (DoC) per product. MM CRA Toolkit produces a per-plugin DoC populated from your Settings and the per-product fields you fill in.

Open the DoC editor

Go to CRA Toolkit → Declarations of Conformity, pick a plugin from the dropdown, and the editor loads with pre-filled defaults.

What the editor asks

Following CRA Annex V section order:

1. Declaration identifier

A unique ID for this declaration. Auto-assigned on first save (e.g. MMCRA-DOC-mm-table-pro-2026). Stable across updates — once issued, the same product keeps the same DoC ID through every version.

2. Manufacturer

Pre-filled from CRA Toolkit → Settings → Company. Read-only here — edit in Settings if it's wrong.

EU authorised representative

If you enabled an EU rep during the Setup Wizard, their details auto-fill from Settings.

3. Statement of responsibility

Standard CRA boilerplate. Not editable.

4. Object of the declaration

The per-product fields:

Product name — your plugin's display name (e.g. "MMTable Pro")
Version covered — the version this declaration applies to (e.g. "1.13.0")
Product type — defaults to "WordPress plugin"
Product URL — your product page on your marketing site
Risk classification — Default (Article 7), Important (Annex III), or Critical (Annex IV). Most WordPress plugins are Default.
Intended use — 2-3 sentences describing the purpose and target users

5. Conformity statement

Standard CRA language naming Regulation 2024/2847. Not editable.

6. Standards applied

Pre-populated with ISO/IEC 29147 (Vulnerability disclosure) and ISO/IEC 30111 (Vulnerability handling). Add more per product if relevant (e.g. WCAG 2.1 AA if your plugin has a UI component, ISO 27001 if you operate under one).

7. Conformity assessment

The route you used:

Internal control (self-assessment) — Module A, Annex VIII. Most plugins.
EU-type examination — Module B + C, Annex VIII. Required for "important" products under Annex III.
Full quality assurance — Module H, Annex VIII. Required for "critical" products under Annex IV.

If you picked B+C or H, the notified body fields below activate (name, ID number, certificate reference).

8. Additional information

Optional free-text field for caveats, version-history references, or scope clarifications.

Signed

For and on behalf of — auto-filled from manufacturer
Name — the signer
Role — their title
Place — where signed (city, country)
Date — date of signature

Export

Click Export as HTML. The toolkit writes the DoC to wp-content/uploads/mmcra/doc/doc-<slug>-YYYYMMDD-HHMMSS.html and offers a download link. Open in any browser, print to PDF, sign by hand or with DocuSign, and file.

The exported HTML includes a faint footer with your toolkit version and license fingerprint. This is the watermark — don't strip it, regulators don't care about it, but if the DoC ever shows up where it shouldn't be we can trace the leak.

License-gated

DoC editing is open without a license, so you can prepare drafts. Export requires an active license (with grace window). That's the gate the toolkit uses to enforce paid usage on the artifact output.

Re-signing for a new version

The convention is: re-issue the DoC every time you ship a major version. Open the editor, update the Version covered field, change the date, re-export, re-sign. Keep all previous versions in your technical file.

The audit log records every DoC export with a SHA-256 hash of the HTML, so the history is preserved automatically.