CRA Reference

Information and instructions to the user (Annex II)

Primary audience:LegalDeadline:

Published on

Annex II is short, often overlooked, and breaching it is formal non-compliance immediately observable by an authority that buys the product off the shelf. It is the cheapest inspection to run, and therefore the most likely.

The mandatory items

Supplied with the product, in a language easily understood by users and market surveillance authorities.

  1. Name, registered trade name or registered trademark of the manufacturer, postal address, email address or other digital contact, and where applicable a website.
  2. A single point of contact for reporting vulnerabilities and receiving information in return, with an indication of where it is located.
  3. Name and type of the product, with traceability elements: reference, version.
  4. Intended purpose, including the intended security environment, and the main security features.
  5. Any known or foreseeable circumstance related to the use of the product in accordance with its intended purpose, or under conditions of reasonably foreseeable misuse, that may lead to a cybersecurity risk.
  6. Where applicable, the internet address at which the EU declaration of conformity can be accessed.
  7. The type of security technical support offered and the end date of the support period, at least the month and year, in a clear and understandable manner.
  8. Detailed instructions — or the internet address pointing to them — covering: security measures at commissioning and during operation, the effect of configuration changes, how to install updates securely, secure decommissioning, data retention and reset.
  9. Where the product supports automatic updates, information on the mechanism and on the ability to disable it.
  10. Where applicable, an indication of where the software bill of materials (SBOM) can be obtained.

Cybersecurity notice template

To adapt per product, in two pages.

CYBERSECURITY NOTICE — Acme Gateway AG-4200, version 4.2.x

1. MANUFACTURER
   [Legal name], [full postal address]
   [email] — [website]

2. REPORTING A VULNERABILITY
   Contact point: psirt@[domain] — [country where the contact point is located]
   Disclosure policy: [URL]
   Public encryption key: [URL]

3. PRODUCT IDENTIFICATION
   Name, reference, versions covered by this notice.

4. INTENDED PURPOSE AND SECURITY ENVIRONMENT
   The product is designed for [use]. It assumes an environment in which
   [assumptions: segmented network, controlled physical access, etc.].
   Main security features: [list].

5. KNOWN RISKS AND DISCOURAGED USES
   [Circumstances that may lead to a risk, including reasonably foreseeable
   misuse.]

6. EU DECLARATION OF CONFORMITY
   Available at: [URL]

7. SECURITY SUPPORT
   Security updates provided until: [month year]
   Published fixes remain available until: [month year]
   Nature of support: [description]

8. INSTRUCTIONS
   Secure commissioning: [URL or text]
   Effects of configuration changes: [URL or text]
   Installing updates: [URL or text]
   Secure decommissioning and data erasure: [URL or text]
   Reset to original state: [URL or text]

9. AUTOMATIC UPDATES
   Enabled by default: yes / no. Mechanism: [description].
   Disabling: [procedure]. Consequences of disabling: [text].

10. SOFTWARE BILL OF MATERIALS (SBOM)
    Available: [portal URL / on request at …] / not disclosed.

Watch points

Location of the contact point. The Annex requires stating where the contact point is located. An email address alone is not enough: the country must be given.

“Language easily understood”. For pan-European distribution that implies a translation chain and a consistency check across language versions. Member States may require their own language.

Format. The notice may point to an internet address for detailed instructions, but the main items must accompany the product. A wholesale redirect to a website is not compliant, and a link that stops working once the product is off the market is less so.

Consistency. Three pieces of information circulate across several documents at once: the end-of-support date, the contact point, the address of the declaration. They must be generated from a single source, or they will diverge.

Retention

The information and instructions must remain available for at least ten years after placing on the market, or the support period if longer — like the technical documentation.

That means a URL cited in a 2028 notice must still respond in 2038. A persistent-URL policy is therefore a compliance matter, not merely a communications one.