The paperwork drifts silently
A configuration change nobody logged against the Declaration is the normal case, not the exception — and it is invisible until an auditor, insurer, or regulator asks.
For manufacturers placing machines on the EU market
Your Declaration of Conformity is only true the day you sign it.
You shipped a machine with a Declaration of Conformity, a risk assessment, and a CE mark. Every firmware patch, scanner re-zone, or PLC change since then is a day that Declaration has been quietly less true — and nothing in your process says so.
The clocks that apply to youCRA Art. 14 puts a 24-hour clock on you the moment a vulnerability in a product you placed on the market is actively exploited — even for products sold before 11 Dec 2027 (Art. 69(3)). Machinery Reg. Annex III 1.1.9 requires you to identify the safety-relevant software on the machine and record evidence of intervention, applying 20 Jan 2027.
Why this matters for manufacturers
What the paperwork stops telling you
A supplier advisory names your components, not your machines
Matching a CVE or safety advisory to which serial numbers actually run the affected firmware is manual, error-prone, and usually skipped.
You need evidence, not a promise
A Declaration bound to a configuration hash can be shown to have stopped describing the machine — on a date, not an argument.
What this checks
Proof, not a pitch
Declarations bound to a configuration hash
The Cell tier binds a Declaration of Conformity to a configuration hash, so drift becomes a checkable date.
Read more
Fleet advisory fan-out
One supplier advisory matched against every enrolled serial by hash, then version, then name — never version-range arithmetic.
Read moreYour Declaration of Conformity is only true the day you sign it.
Verification stays free, forever, at every tier. Start there.