Provide instructions and information to users (Annex II)

Article 13(16) of Regulation (EU) 2024/2847 requires that manufacturers ensure the product with digital elements is accompanied by the information and instructions to the user referred to in Annex II, in paper or electronic form, in a language easily understood by users and market surveillance authorities of the Member States in which the product is made available.

Annex II requires that users are provided with:

1. Product identification — name, type, version, manufacturer details
2. Intended purpose — what the product is for and its security-relevant functions
3. Security properties — description of cybersecurity features
4. Support period — end date of security update support
5. Point of contact — how to report vulnerabilities (see OBL-ART13-07)
6. Update mechanism — how to receive and apply security updates
7. Secure configuration guidance — how to set up and use the product securely
8. Default configuration — any credentials supplied must be unique per product or instructions to change defaults must be included
9. EU DoC reference — where the EU Declaration of Conformity can be found

• The language must be "easily understood by users" — in practice, this means the official language(s) of each Member State where the product is made available
• For software products, the on-screen UI language is not sufficient alone — the Annex II information must be specifically provided

• Annex II-compliant user manual or documentation
• Confirmation that documentation is available in relevant Member State languages
• Records showing documentation was updated when support period end dates changed
• Screenshot showing where EU DoC reference is surfaced to users