Information and instructions to the user

Information and instructions to the user are the information package that Article 13(18) of the Cyber Resilience Act (CRA) requires to accompany every product with digital elements. Annex II sets out in nine points what it has to contain as a minimum.

This is not the user manual in the familiar sense. The CRA prescribes a minimum content shaped entirely around security, and Article 13(18) names the purpose as well: the material must allow secure installation, operation and use of the product. Existing manuals can be reused for it, but they rarely cover the minimum content in full.

The nine mandatory items in Annex II

• the manufacturer’s name, registered trade name or registered trademark, plus postal address, email address or other digital contact and, where available, the website (point 1)
• the single point of contact for reporting vulnerabilities and the place where the coordinated vulnerability disclosure policy can be found (point 2)
• name, type and anything else that makes the product uniquely identifiable (point 3)
• the intended purpose including the security environment provided by the manufacturer, together with the essential functionalities and the security properties (point 4)
• any known or foreseeable circumstance, whether in use according to the intended purpose or under reasonably foreseeable misuse, that may lead to significant cybersecurity risks (point 5)
• where applicable, the internet address at which the EU declaration of conformity can be accessed (point 6)
• the type of technical security support offered and the end date of the support period (point 7)
• detailed instructions on six expressly listed matters, or an internet address leading to them (point 8)
• if the manufacturer releases the software bill of materials, where it can be accessed (point 9)

Point 8 is the one most often underestimated, because it carries six sub-points of its own: the measures needed at initial commissioning and throughout the product lifetime (a), how changes to the product can affect the security of data (b), how security-relevant updates are installed (c), secure decommissioning including secure removal of user data (d), how to turn off the default automatic installation of security updates (e), and, for products meant for integration into other products, the information an integrator needs for Annex I and Annex VII (f).

Form, language and availability

Article 13(18) accepts paper and electronic form alike. The language must be one that users and market surveillance authorities can easily understand, and the material must be clear, understandable, intelligible and legible.

The retention rule matches the one for conformity paperwork: at least ten years from placing on the market, or for the support period where that runs longer. The English text names users and market surveillance authorities as the audience, the German text only users; serving both is the safe reading. Where the material is published online, the page has to stay accessible and user-friendly for that same period. A product page taken down when sales end breaches this duty.

What else Article 13 requires

Four further paragraphs of Article 13 sit right alongside this and are routinely confused with Annex II:

• Paragraph 15: a type, batch or serial number or other identifying element, on the product itself or, where that is not possible, on the packaging or in an accompanying document.
• Paragraph 16: the manufacturer’s name and contact details on the product, its packaging or an accompanying document; the English text puts the three places on an equal footing, the German text puts the product first and allows the others only where the product itself is not possible. The same details also belong in the Annex II information.
• Paragraph 19: the end date of the support period, clearly and understandably and in an easily accessible manner, with at least the month and the year, at the time of purchase. Where technically feasible given the nature of the product, manufacturers must also display a notice to users that the end of the support period has been reached.
• Paragraph 20: a copy of the EU declaration of conformity, or a simplified version following the model in Annex VI that states the exact internet address of the full declaration.

Paragraph 19 carries the sharpest practical consequence. The end date has to be specified at the time of purchase in an easily accessible manner and, where applicable, on the product itself, on its packaging or by digital means. A leaflet inside the box does not achieve that, because anyone reading it has already bought.

Also part of the technical documentation

Annex VII, point 1(d), pulls the information and instructions to the user into the technical documentation. Article 31(2) therefore applies: the documentation must be drawn up before placing on the market and continuously updated, where appropriate, at least during the support period. If the contact point moves or the support period is extended, the published version has to follow.

Checked along the supply chain

Under Article 19(2)(c), importers must satisfy themselves before placing a product on the market that it comes with the EU declaration of conformity and the Annex II information in a language that users and market surveillance authorities can easily understand. Under Article 20(2)(b), distributors verify that manufacturer and importer have met Article 13(15), (16), (18), (19) and (20) as well as Article 19(4). Missing user information is therefore not a matter between manufacturer and customer; it is a reason for a channel partner to refuse the goods.

The duty applies from 11 December 2027. Infringements of Article 13 fall into the top penalty tier of Article 64(2): up to EUR 15 000 000 or, in the case of undertakings, up to 2.5 % of total worldwide annual turnover for the preceding financial year, whichever is higher.