Checklist
Cyber Resilience Act: What the Manual Needs
The Short Answer
One New Section, Kept True for Years
The Cyber Resilience Act applies from 11 December 2027 (Article 71(2)). Under Article 13(18), manufacturers must ensure each product with digital elements is accompanied by the information and instructions in Annex II, in paper or electronic form. That is a content set most manuals do not have today: the security environment, the support end date, and procedures for updates and decommissioning.
It is also a maintenance duty. The information must stay available for at least 10 years after the product is placed on the market or for the support period, whichever is longer. This page is a reading aid, not legal advice. Read the text of the Regulation, and confirm what applies to your products with your conformity assessment advisers.
Dates
Reporting Has Started; the Manual Duty Is Next
Article 71(2) staggers the Regulation. Chapter IV (Articles 35 to 51) applied from 11 June 2026. Article 14, which requires manufacturers to report actively exploited vulnerabilities and severe incidents, applied from 11 September 2026. Everything else, including the Annex II duty, applies from 11 December 2027.
Article 14 is not a manual duty, but it touches the same team. Under Article 14(8), after learning of an actively exploited vulnerability or severe incident, the manufacturer must inform affected users and, where necessary, of the mitigation and corrective measures they can take. Annex II points 2 and 8 are the parts of the manual that tell users whom to contact and how to apply security updates.
The Checklist
Annex II, Item by Item
Annex II opens with "At minimum, the product with digital elements shall be accompanied by" the nine items below. The wording is paraphrased; the notes are our reading of how each lands in a manual.
1. Manufacturer identity and contact
Name, registered trade name or trademark; postal address, email or other digital contact; the website where available.
In the manual: Article 13(16) also wants these on the product, its packaging, or an accompanying document, in a language users and authorities easily understand.
2. Single point of contact for vulnerabilities
Where vulnerabilities of the product can be reported and received, and where the coordinated vulnerability disclosure policy can be found.
In the manual: Article 13(17): easy to identify, and it may not limit users to automated tools.
3. Product identification
Name, type, and any additional information that identifies the product uniquely.
In the manual: Tie the manual to the exact model and software version, so variants with different security behavior are not mixed.
4. Intended purpose and security environment
The intended purpose, including the security environment the manufacturer provides, the essential functions, and information about the security properties.
In the manual: This is new content for most manuals: what the product assumes about its network and surroundings.
5. Known or foreseeable risk circumstances
Any known or foreseeable circumstance, in use as intended or under reasonably foreseeable misuse, that may lead to significant cybersecurity risks.
In the manual: Write it as a warning users can act on, and keep it in step with the safety warnings elsewhere in the manual.
6. Where to find the EU declaration of conformity
Where applicable, the internet address at which the declaration can be accessed.
In the manual: Article 13(20) allows a simplified declaration shipped with the product, which must carry the exact address of the full one.
7. Security support type and end date
The type of technical security support offered, and the end date of the support period during which users can expect vulnerabilities to be handled and security updates delivered.
In the manual: Article 13(19) adds that the end date, with at least month and year, must be clear at the time of purchase. See the next sections.
8. Detailed instructions, or the address of them
Six sub-items. (a) Measures for secure commissioning and throughout the product's lifetime. (b) How changes to the product can affect data security. (c) How security-relevant updates are installed. (d) Secure decommissioning, including removing user data. (e) How the default of automatic security updates can be turned off. (f) For a product meant to be integrated into another one, the information the integrator needs for Annex I and the Annex VII documentation.
In the manual: Annex II allows an internet address in place of the text. Whatever sits behind that address is still part of the Annex II information, so the retention rule applies to it.
9. Software bill of materials location
Only if the manufacturer decides to make the SBOM available to the user: where it can be accessed.
In the manual: Part II of Annex I separately requires the manufacturer to draw up an SBOM; giving users access is the manufacturer's choice.
Delivery
How Article 13(18) Wants It Delivered
The information must be in a language users and market surveillance authorities easily understand, and be clear, understandable, intelligible, and legible. It must allow secure installation, operation, and use of the product. Paper or electronic form is the manufacturer's choice, and there is no request mechanism like the paper-on-request clauses in some other EU rules (compare them in our side-by-side of EU digital instruction rules).
The same paragraph sets retention: at the disposal of users and authorities for at least 10 years after the product is placed on the market or for the support period, whichever is longer. If provided online, it must be accessible, user-friendly, and available online for that period. The Machinery Regulation, which may apply to the same product, has its own duration rule; see the briefing on Article 10(7).
Support Period
The Date That Has to Match Everywhere
Article 13(8) requires the support period to reflect how long the product is expected to be in use, and to be at least five years, or the expected use time where that is shorter. Article 13(19) requires its end date, with at least the month and year, to be clearly and understandably specified at the time of purchase in an easily accessible manner and, where applicable, on the product, its packaging, or by digital means. Where technically feasible, the manufacturer must also show users a notification when the support period has ended.
Annex II point 7 puts the same date in the manual. So one fact appears in at least three places: the manual, the point of sale, and the product or packaging. Hold it as a single value in a single source and reuse it, so a correction cannot reach one place and miss another.
Staying Current
Keeping the Section True Across the Support Period
Annex II information describes the product as shipped, but several items change in service: the contact point, the disclosure policy address, how updates are installed, the SBOM location, and the support end date itself. A practical routine, drawn from the text above rather than prescribed by it:
- Keep the Annex II section as its own module, versioned against the product model and software release it describes, so a change in one product does not rewrite the others.
- Treat any address named in the manual (disclosure policy, declaration of conformity, SBOM, detailed instructions) as content that must keep resolving for the whole retention period, and test it on a schedule.
- When a security update changes how updates are installed or how automatic installation is turned off (items 8(c) and 8(e)), revise the section in the same release.
- Keep earlier editions retrievable. The retention period runs from placing on the market, so units sold in different years may be owed different editions; this is the same discipline as effective-dated publishing.
- Keep this section separate from the Annex VII technical documentation. The factors used to determine the support period go into the technical documentation under Article 13(8), not into the manual.
On wording, the international standard for instructions for use is IEC/IEEE 82079-1, and warnings, cautions, and notes covers how the risk circumstances in item 5 sit beside other safety content. If you are weighing tooling for this kind of reuse, see our CCMS requirements guide.
Not Legal Advice
Read the Regulation Itself
This page is a reading aid, not legal advice. It covers the user-information duty in Article 13 and Annex II, not conformity assessment, the Annex I essential requirements, or the Article 14 reporting process. Whether a product is in scope, which exclusions apply, and what Commission guidance or harmonized standards say about Annex II content are questions for the text and your advisers.
FAQ
Questions We Hear
Who has to supply Annex II information?
Manufacturers of products with digital elements, which Article 3(1) defines as a software or hardware product and its remote data processing solutions, including components placed on the market separately. Article 2 sets the scope and its exclusions; read it against your product before assuming the Act applies or does not.
When does the manual duty start?
Article 71(2) says the Regulation applies from 11 December 2027. Two parts started earlier: Chapter IV (Articles 35 to 51) on 11 June 2026 and Article 14, on reporting actively exploited vulnerabilities and severe incidents, on 11 September 2026. Article 13(18), which carries the Annex II duty, falls under the main date.
Can the information be digital only?
Article 13(18) allows paper or electronic form and has no paper-on-request clause. If it is online, it must be accessible, user-friendly, and available for at least 10 years after the product is placed on the market or for the support period, whichever is longer. Our comparison of EU digital instruction rules sets this beside the other regimes.
How long is the support period?
Article 13(8) says it must reflect how long the product is expected to be in use, and be at least five years. Where the product is expected to be in use for less than five years, the support period corresponds to the expected use time. The factors considered go into the Annex VII technical documentation, not the manual.
Does Annex II replace the safety instructions in the manual?
No. Annex II names the minimum the product must be accompanied by for cybersecurity. Machinery, batteries, product safety, and other rules carry their own instructions content, and a product can fall under several. Merge the content into one manual; do not assume one rule's list covers another's.
Get In Touch
Plan the Annex II Section Before It Is Due
If your products fall under the Cyber Resilience Act, the manual needs a new section and a way to keep it current. Tell us what you publish and where it ships.