---
title: "Ship the user information the Cyber · Agent Wranglers"
url: https://agentwranglers.se/playbook/documentation/help-centres-and-user-guides/cra-user-information
id: DOC-39
level: Required
applies: digital-product
region: EU
risk: law
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1416
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Ship the user information the Cyber Resilience Act lists

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Help centres and user guides](https://agentwranglers.se/playbook/documentation/help-centres-and-user-guides.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: DOC-39
- Level: Required
- Chapter: [Help centres and user guides](https://agentwranglers.se/playbook/documentation/help-centres-and-user-guides.md)
- Rule: From 11 December 2027, give every product the Act covers its identifier, the maker's name and contact details, and the user information in Annex II. That includes the support end date with month and year.
- Check: For each covered product, a test fetches its instructions page. The page shows the product identifier, the maker's name and a postal or email address. It also shows a security contact and a support end date as month and year. The date matches the sales page.
- Risk: A law broken
- Applies when: The project sells or hands out software or devices that others run, not only a hosted service.
- Region: European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.
- Review by: 2027-12-11
- How: The Commission's summary says the instructions must be "clear, understandable, intelligible and legible". They must also allow the product to be installed, run and used securely. Write them in a language users can understand, as [Show product safety information in the buyer's language](https://agentwranglers.se/playbook/localization/language-laws/product-safety-language.md) explains for each country. Publish them as accessible pages, as [Make product instructions accessible as the law requires](https://agentwranglers.se/playbook/documentation/help-centres-and-user-guides/accessible-instructions.md) says. Show the same support end date at the point of sale, as [Handle vulnerabilities for the whole support period](https://agentwranglers.se/playbook/compliance/security-laws/cra-support-period.md) asks. Name the contact for security reports from [Publish a security policy with the code](https://agentwranglers.se/playbook/open-source/vulnerabilities-and-advisories/security-policy.md). Whether the Act covers the product is decided in [Decide whether the Cyber Resilience Act covers your product](https://agentwranglers.se/playbook/compliance/security-laws/cra-scope.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
// Test: the instructions page carries the Annex II basics
test('instructions name the support end date and contacts', async () => {
  const page = await (await fetch('https://example.com/docs/bakery-display/security')).text();
  expect(page).toMatch(/Model BD-200/);
  expect(page).toMatch(/security@example\.com/);
  expect(page).toMatch(/Security updates until (January|February|March|April|May|June|July|August|September|October|November|December) \d{4}/);
});
```

### Python example

```python
# Test: the instructions page carries the Annex II basics
import re, urllib.request

def test_instructions_name_the_support_end_date_and_contacts():
    page = urllib.request.urlopen("https://example.com/docs/bakery-display/security").read().decode()
    assert "Model BD-200" in page
    assert "security@example.com" in page
    assert re.search(r"Security updates until [A-Z][a-z]+ \d{4}", page)
```

## Sources

- [European Commission: Cyber Resilience Act summary](https://digital-strategy.ec.europa.eu/en/policies/cra-summary)
- [Regulation (EU) 2024/2847, Article 13 and Annex II](https://eur-lex.europa.eu/eli/reg/2024/2847/oj)

## Related rules

- LOC-43 [Show product safety information in the buyer's language](https://agentwranglers.se/playbook/localization/language-laws/product-safety-language.md) in Localization
- DOC-27 [Make product instructions accessible as the law requires](https://agentwranglers.se/playbook/documentation/help-centres-and-user-guides/accessible-instructions.md) in Documentation
- CMP-50 [Handle vulnerabilities for the whole support period](https://agentwranglers.se/playbook/compliance/security-laws/cra-support-period.md) in Compliance and governance
- OSS-47 [Publish a security policy with the code](https://agentwranglers.se/playbook/open-source/vulnerabilities-and-advisories/security-policy.md) in Open source maintenance
- CMP-48 [Decide whether the Cyber Resilience Act covers your product](https://agentwranglers.se/playbook/compliance/security-laws/cra-scope.md) in Compliance and governance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/documentation/help-centres-and-user-guides/cra-user-information">Agent Wranglers documentation playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Make product instructions accessible as the law requires](https://agentwranglers.se/playbook/documentation/help-centres-and-user-guides/accessible-instructions.md)
- Next: [Publish a system card for every AI feature](https://agentwranglers.se/playbook/documentation/help-centres-and-user-guides/ai-system-card.md)
- [Help centres and user guides](https://agentwranglers.se/playbook/documentation/help-centres-and-user-guides.md)