Skip to content

Product conformity

The Conformity tab on a product workspace tracks the technical documentation a CRA manufacturer must be able to produce on demand, and the conformity assessment route the product's risk class forces.

This is a working checklist with owners and references, not a CE-marking generator. alloy-it does not issue declarations, does not score your compliance, and does not talk to a notified body. What it does is keep the required set visible, tick off the parts it can prove from data it already holds, and tell you which items are still someone's job.

Path: /products/:productId/conformity

Risk class drives the pathway

Set the product's risk class on the product record. alloy-it derives the required assessment module from it:

Risk class Required pathway Notified body
default Module A: internal control No
important_i Module A: internal control No
important_ii Module B + C: EU type-examination Yes
critical Module B + C: EU type-examination Yes

Important class I may self-assess only when harmonised standards are applied in full. That is a judgement alloy-it cannot infer, so the tab shows Module A as the derived route and lets you record the pathway you actually followed (module_a, module_b_c, module_h) plus the notified body, where one is involved.

Both are shown, so a mismatch between required and recorded is visible rather than buried.

The checklist

Seven items, in the order they are worked through:

Item What it is Reference
Cybersecurity risk assessment The assessment that decides which Annex I Part I requirements apply and how Art. 13(2)–(3), Annex VII(2)
Annex I Part I evidence Evidence the product properties are met: secure defaults, access control, confidentiality and integrity, minimised attack surface, safe error handling Annex I Part I
Third-party component due diligence Record of due diligence over third-party and open source components Art. 13(5)
Software bill of materials Machine-readable SBOM covering at least top-level dependencies Annex I Part II(1)
Disclosure policy and security contact Published CVD policy and a single reporting address Annex I Part II(5)
EU Declaration of Conformity The Annex V declaration, drawn up before placing on the market Art. 28, Annex V
Declared support period At least five years unless the expected lifecycle is shorter, communicated at point of purchase Art. 13(8)

Item keys are stable identifiers (risk_assessment, annex_i_evidence, due_diligence, sbom, cvd_policy, declaration_of_conformity, support_period). Labels can change; the keys cannot.

Derived items

The two items in bold are derived. alloy-it reports them rather than asking you to tick them:

  • SBOM is satisfied when a release under the product carries an inventory, vendor or firmware-derived. The row shows the actual count: "7 of 9 releases carry an inventory."
  • Support period is satisfied by the product's support end date.

Derived observation wins over a hand-set status, because a status that contradicts the data is worse than no status at all.

The one exception is an explicit not applicable, which stays as recorded, since only you know when an item genuinely does not apply.

Per-item state

Each row carries:

Field Purpose
Status not_started, in_progress, complete, not_applicable
Owner Who is accountable
Reference URL Where the document actually lives: your DMS, wiki, or repo
Notes Anything an assessor would ask about
Updated by / at Audit trail

alloy-it stores the pointer, not the document. Keeping the risk assessment PDF in your document system and the link here is the intended shape.

How it fits the rest of the platform

Checklist item Fed by
SBOM Products and releases: vendor upload or firmware analysis
Due diligence Triage decisions and the component inventory
Disclosure policy The public advisories portal and your security contact in Settings → PSIRT alerts
Annex I evidence Deep analysis findings, where you run it
Support period The product's support end date, which also bounds your Art. 13(8) obligations

The per-release evidence pack is the other half: the checklist says what documentation must exist, the evidence pack is the export of what alloy-it holds for one release.

What this is not

  • Not a compliance score. There is no percentage, and completing every row does not mean you are conformant.
  • Not a document generator. alloy-it does not write your risk assessment or your DoC.
  • Not a substitute for a notified body where Module B + C applies.