What this screen covers
This page asks whether the user-facing Annex II information is in place. It is not a CRA readiness test, a reporting-deadline test, a support-period calculator, or a vulnerability-evidence file review.
Annex II overview
Products with digital elements are accompanied by the information and instructions in Annex II. They may be on paper or electronic. They have to be clear, understandable, intelligible, and legible, and they have to support secure installation, operation, and use.
Manufacturer contact
The set identifies the manufacturer, including the name or registered trade name, a postal address, and an email or other digital contact. A website is recorded only where one is available.
Vulnerability reporting contact
The manufacturer gives one contact for vulnerability reporting that a user can identify without relying only on automated tools. A chatbot or an automated form by itself is not treated as enough.
Product identification
The information identifies the product well enough to tell it apart. Intended purpose, the relevant security environment, and essential functions or security properties are separate points.
Secure-use instructions
Instructions cover secure installation and secure operation or use. This screen records whether those instructions exist. It does not store the text.
Support-period disclosure
The support-period end date, including month and year, is shown clearly at the time of purchase. The length of that period is decided on the CRA Support Period Planner, not here.
Language
The information is in a language users and market-surveillance authorities in the relevant Member State can easily understand, and a review of clarity, intelligibility, and legibility is recorded.
Retention
Online Annex II information stays available for at least 10 years after the product is placed on the market, or for the support period, whichever is longer. Security updates made available during the support period stay available for at least 10 years after they are issued, or for the rest of the support period, whichever is longer. Those two clocks stay separate.
How the screen reads common cases
- Instructions can be present and the support end date still missing. That is a support-period disclosure gap.
- A date without month and year is still a support-period disclosure gap.
- A vulnerability contact that accepts only an automated message is a vulnerability contact gap.
- Online instructions without a retention plan are an information retention gap.
- When every applicable item is present, the set is ready for review, with the non-compliance sentence still shown.
Limits
Answers stay inside the enums. There is no score. A ready result is not a certificate and does not mean the product is safe. Names, addresses, emails, product names, and URLs are not stored. Later Commission guidance is a manual ruleset update.