CRA Annex II: what manufacturers must tell the user, point by point

Annex II is titled "Information and instructions to the user." Where Annex I sets the essential cybersecurity requirements a product and its manufacturer's processes must meet, and Annex VII lists the technical documentation a manufacturer keeps on file for market surveillance authorities, Annex II is the user-facing counterpart: the minimum information that must physically or digitally accompany the product so that the person using it — not a regulator — knows who made it, how to reach them, how long it will be supported, and how to use, update and retire it securely.

Article 13(18) is the operative clause that turns Annex II from a list into a legal duty: "Manufacturers shall ensure that products with digital elements are accompanied by the information and instructions to the user set out in Annex II, in paper or electronic form." The same paragraph requires that information to be in a language users and market surveillance authorities can easily understand, and to be "clear, understandable, intelligible and legible," allowing for the secure installation, operation and use of the product.

Annex II opens with: "At minimum, the product with digital elements shall be accompanied by" the following. This table paraphrases each point next to the regulation's own wording.

Point (8)'s six sub-points, quoted directly from the regulation, are the detailed instructions (or the link to them):

• (a) "the necessary measures during initial commissioning and throughout the lifetime of the product with digital elements to ensure its secure use"
• (b) "how changes to the product with digital elements can affect the security of data"
• (c) "how security-relevant updates can be installed"
• (d) "the secure decommissioning of the product with digital elements, including information on how user data can be securely removed"
• (e) "how the default setting enabling the automatic installation of security updates, as required by Part I, point (2)(c), of Annex I, can be turned off"
• (f) "where the product with digital elements is intended for integration into other products with digital elements, the information necessary for the integrator to comply with the essential cybersecurity requirements set out in Annex I and the documentation requirements set out in Annex VII"

Point (8)(e) and (8)(f) are the two places Annex II explicitly cross-references another annex in its own text: (e) points back to the automatic-update default in Annex I Part I point (2)(c), and (f) points to both Annex I (essential requirements) and Annex VII (technical documentation) for the specific case of a component meant to be integrated into someone else's product.

Article 13 — "Obligations of manufacturers" — is where Annex II stops being a list and becomes an enforceable duty, and it layers several requirements on top of the bare annex text:

• Paragraph 16 requires the manufacturer's name, trade name or trademark and contact details to appear on the product, its packaging, or an accompanying document, and in the Annex II information — tying point (1) to physical/packaging labelling, not just a manual.
• Paragraph 17 requires manufacturers to "designate a single point of contact to enable users to communicate directly and rapidly with them, including in order to facilitate reporting on vulnerabilities," that the point of contact be "easily identifiable by the users," included in the Annex II information, and that it "allow users to choose their preferred means of communication" rather than being limited to automated tools only.
• Paragraph 18 sets the format and durability rules: paper or electronic form, understandable language, clear and legible, and — this is a distinct retention duty from the technical-documentation retention in paragraph 13 — the Annex II information itself must be kept available to users and market surveillance authorities for "at least 10 years after the product with digital elements has been placed on the market or for the support period, whichever is longer," with the same minimum period applying to online accessibility if provided that way.
• Paragraph 19 puts a sharper point on Annex II point (7): the support-period end date "including at least the month and the year" must be "clearly and understandably specified at the time of purchase in an easily accessible manner," not just somewhere in the documentation — on the product, its packaging, or by digital means where applicable — and, "where technically feasible," the manufacturer must notify users when the product actually reaches end of support.
• Paragraph 15 requires the product to "bear a type, batch or serial number or other element allowing their identification," which is the identification data that feeds Annex II point (3).
• Paragraph 8 is where the support period itself gets defined — manufacturers determine it based on expected use time, with a floor of five years unless the product's expected use is genuinely shorter — and that determination is what point (7)'s end-date disclosure and paragraph 19's point-of-purchase disclosure both report on.

They are three different audiences for three different things, and the regulation's own cross-references in point (8)(e) and (8)(f) confirm the link rather than leaving it implicit:

• Annex I sets what the product and the manufacturer's processes must actually be — secure by default, updatable, vulnerabilities handled — and Annex II point (8)(e) directly cross-references Annex I Part I point (2)(c) (the automatic-update default) when describing the instruction for turning that default off.
• Annex VII ("Content of the technical documentation," confirmed from the regulation's own table of contents) is what the manufacturer keeps on file for market surveillance authorities to inspect — the evidence behind the conformity claim. Annex II point (8)(f) cross-references Annex VII specifically for the case of a component meant to be integrated into another product: the integrator needs enough information to meet Annex VII's documentation requirements for the combined product, not just Annex I's technical requirements.
• Annex II is what goes to the user, in understandable language, not to a market surveillance authority's file. A user doesn't need the full technical documentation; they need the contact point, the support end date, and instructions they can act on.

Put together: Annex I is the substance, Annex VII is the regulator's evidence trail, and Annex II is the user's instruction sheet — each one accompanying the product for a different reader. For the Annex I side, see our CRA Annex I explained guide; this guide has deliberately not repeated Annex I's point-by-point content here.

This guide's fetched sources describe Article 13's obligations and Annex II's list itself in detail, but did not surface the specific enforcement or penalty clause text (Chapter VII covers "Confidentiality and penalties," Articles 63-65) in enough verified detail to state a specific fine figure or enforcement mechanism here with confidence. What is clear from Article 13 itself is that Annex II is not optional paperwork: paragraph 18's retention duty, paragraph 19's point-of-purchase disclosure rule, and paragraph 17's single-point-of-contact requirement are all drafted as "shall" obligations sitting alongside the same Article 13 duties (technical documentation, EU declaration of conformity, CE marking) that trigger market surveillance action under Chapter V when a product is found non-compliant. Treat missing or buried Annex II information as a compliance gap of the same kind as a missing declaration of conformity, not a minor documentation nicety — and confirm the actual penalty regime against Articles 63-65 before relying on any specific figure.