Information and instructions to the user (Annex II)

Information and instructions to the user are the details under Annex II that the manufacturer must supply with every product. They are meant to enable users to set up, operate and decommission the product securely.

Definition in the Regulation

Article 13(18) of Regulation (EU) 2024/2847 requires the information under Annex II to accompany the product in paper or electronic form, in a language users can easily understand, and to remain available for at least ten years or for the support period. Annex II sets out the minimum content:

• the manufacturer and its contact details (point (1))
• the single point of contact for reporting vulnerabilities and where the disclosure policy can be found (point (2))
• name and type of the product (point (3))
• intended purpose, security environment and security properties (point (4))
• known circumstances that may lead to significant risks, including reasonably foreseeable misuse (point (5))
• where applicable, the internet address of the declaration of conformity (point (6))
• the type of security support and the end date of the support period (point (7))
• instructions on commissioning, updates, decommissioning and data removal (point (8))
• where the software bill of materials can be accessed, if the manufacturer makes it available to users (point (9))

Article 13(17) requires the single point of contact to be easily identifiable and to let users choose their means of communication.

What it means for manufacturers

Much of this is already in operating manuals, but three points are usually new: the end date of support, the address for reporting vulnerabilities and the instructions for securely removing all data. Under Article 13(17), users must be able to choose between means of communication, and these must not be limited to automated tools; a single web form is therefore unlikely to be enough, even though a form does not itself count as automated (recital 63). The software bill of materials does not have to be passed on to users; if you do so, state where it can be found. Under Article 20(2), distributors check that the information is supplied. The obligation applies to products placed on the market from 11 December 2027.

Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit

Related terms

• Support period
• Single point of contact for vulnerabilities
• EU declaration of conformity
• Software bill of materials (SBOM)

Learn more

• Manufacturer obligations under Article 13 CRA: an overviewAnnex II in the context of marking, the single point of contact and the declaration of conformity.