Ship the user information the Cyber Resilience Act lists

Region

European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.

Review by

2027-12-11

How to do it

The Commission's summary says the instructions must be "clear, understandable, intelligible and legible". They must also allow the product to be installed, run and used securely. Write them in a language users can understand, as Show product safety information in the buyer's language explains for each country. Publish them as accessible pages, as Make product instructions accessible as the law requires says. Show the same support end date at the point of sale, as Handle vulnerabilities for the whole support period asks. Name the contact for security reports from Publish a security policy with the code. Whether the Act covers the product is decided in Decide whether the Cyber Resilience Act covers your product.

Examples

JavaScript example

// Test: the instructions page carries the Annex II basics
test('instructions name the support end date and contacts', async () => {
  const page = await (await fetch('https://example.com/docs/bakery-display/security')).text();
  expect(page).toMatch(/Model BD-200/);
  expect(page).toMatch(/security@example\.com/);
  expect(page).toMatch(/Security updates until (January|February|March|April|May|June|July|August|September|October|November|December) \d{4}/);
});

Python example

# Test: the instructions page carries the Annex II basics
import re, urllib.request

def test_instructions_name_the_support_end_date_and_contacts():
    page = urllib.request.urlopen("https://example.com/docs/bakery-display/security").read().decode()
    assert "Model BD-200" in page
    assert "security@example.com" in page
    assert re.search(r"Security updates until [A-Z][a-z]+ \d{4}", page)

How to check

For each covered product, a test fetches its instructions page. The page shows the product identifier, the maker's name and a postal or email address. It also shows a security contact and a support end date as month and year. The date matches the sales page.

Sources

• European Commission: Cyber Resilience Act summary
• Regulation (EU) 2024/2847, Article 13 and Annex II

Related rules

• LOC-43 Show product safety information in the buyer's language in Localization
• DOC-27 Make product instructions accessible as the law requires in Documentation
• CMP-50 Handle vulnerabilities for the whole support period in Compliance and governance
• OSS-47 Publish a security policy with the code in Open source maintenance
• CMP-48 Decide whether the Cyber Resilience Act covers your product in Compliance and governance