At minimum, the product with digital elements shall be accompanied by:
How to satisfy it: The user-facing counterpart to the technical file. Article 13 requires the product to be accompanied by this information in paper or electronic form, and to keep it at the disposal of users and market surveillance authorities for at least 10 years after placing on the market or for the support period, whichever is longer. Annex VII (1)(d) then requires the same information inside the technical documentation, so it is written once and filed twice.
the name, registered trade name or registered trademark of the manufacturer, and the postal address, the email address or other digital contact as well as, where available, the website at which the manufacturer can be contacted;
the single point of contact where information about vulnerabilities of the product with digital elements can be reported and received, and where the manufacturer’s policy on coordinated vulnerability disclosure can be found;
How to satisfy it: The single point of contact, and where the coordinated vulnerability disclosure policy can be found. Annex I Part II (5) and (6) require the policy and the reporting channel to exist; this is where the user has to be told they exist and how to reach them.
the intended purpose of the product with digital elements, including the security environment provided by the manufacturer, as well as the product’s essential functionalities and information about the security properties;
any known or foreseeable circumstance, related to the use of the product with digital elements in accordance with its intended purpose or under conditions of reasonably foreseeable misuse, which may lead to significant cybersecurity risks;
where applicable, the internet address at which the EU declaration of conformity can be accessed;
How to satisfy it: Only 'where applicable', because Article 13(20) permits the simplified declaration in Annex VI instead, which itself carries an internet address for the full text.
the type of technical security support offered by the manufacturer and the end-date of the support period during which users can expect vulnerabilities to be handled and to receive security updates;
How to satisfy it: The support period end-date has to be stated to the user, not just decided internally. Annex VII (4) requires you to keep the reasoning behind it in the technical file, so the date appears in two places and they must agree.
detailed instructions or an internet address referring to such detailed instructions and information on: (a) the necessary measures during initial commissioning and throughout the lifetime of the product with digital elements to ensure its secure use; (b) how changes to the product with digital elements can affect the security of data; (c) how security-relevant updates can be installed; (d) the secure decommissioning of the product with digital elements, including information on how user data can be securely removed; (e) how the default setting enabling the automatic installation of security updates, as required by Part I, point (2)(c), of Annex I, can be turned off; (f) where the product with digital elements is intended for integration into other products with digital elements, the information necessary for the integrator to comply with the essential cybersecurity requirements set out in Annex I and the documentation requirements set out in Annex VII.
How to satisfy it: The six sub-points are the operating manual: secure commissioning, the security effect of changes, installing security updates, secure decommissioning and data removal, and (e) how to turn OFF the automatic security updates that Annex I Part I (2)(c) requires to be on by default. Sub-point (f) is the supply chain hook: where the product is intended for integration into another, you must give the integrator what they need to satisfy Annex I and Annex VII.
If the manufacturer decides to make available the software bill of materials to the user, information on where the software bill of materials can be accessed.
How to satisfy it: Note the conditional. Publishing the SBOM to the USER is optional, and this row only requires you to say where it is if you chose to. That is the third and weakest of three different SBOM dispositions in this Regulation, and they are easy to conflate: Annex VII (2)(b) requires the SBOM in the technical file unconditionally, Annex VII (8) requires it to a market surveillance authority on a reasoned request, and this one is discretionary.
Every quoted requirement on this page is verbatim Official Journal text. The surrounding guidance is Legalithm’s commentary and is not regulation. This page states the obligation and its legal basis; it is not legal advice, and the corpus has not been reviewed by counsel.
