What users must be told under the CRA

Mandatory information

Name and contact details of the manufacturer, a single point of contact for reporting vulnerabilities and the disclosure policy, product identification, intended purpose, known circumstances that may lead to significant risks, where to find the declaration of conformity, and the end date of the support period, at least month and year.

Instructions

How to put the product into service securely, how to install security updates, how automatic updates can be switched off and how to decommission the product securely, including secure deletion of user data.

Where it goes

On paper or electronically; a target page behind a QR code on the product is a practical place that can be kept up to date along with the updates.