Information and instructions to the user 使用者的資訊與說明

At minimum, the product with digital elements shall be accompanied by:

具數位元素產品至少應隨附下列各項：

1. the name, registered trade name or registered trademark of the manufacturer, and the postal address, the email address or other digital contact as well as, where available, the website at which the manufacturer can be contacted;

1. 製造商之名稱、註冊商業名稱或註冊商標，以及郵遞地址、電子郵件地址或其他數位聯絡方式，並於可提供時附上可聯繫製造商之網站；

2. the single point of contact where information about vulnerabilities of the product with digital elements can be reported and received, and where the manufacturer's policy on coordinated vulnerability disclosure can be found;

2. 可通報並接收具數位元素產品弱點資訊之單一聯絡窗口，及可取得製造商協調弱點揭露政策所在；

3. name and type and any additional information enabling the unique identification of the product with digital elements;

3. 具數位元素產品之名稱、類型以及可達成獨特識別之任何額外資訊；

4. the intended purpose of the product with digital elements, including the security environment provided by the manufacturer, as well as the product's essential functionalities and information about the security properties;

4. 具數位元素產品之預期用途，含製造商所提供之安全環境、以及產品之基本功能與關於安全屬性之資訊；

5. any known or foreseeable circumstance, related to the use of the product with digital elements in accordance with its intended purpose or under conditions of reasonably foreseeable misuse, which may lead to significant cybersecurity risks;

5. 任何依預期用途使用或於合理可預見誤用條件下使用具數位元素產品相關、可能導致重大網路安全風險之已知或可預見情境；

6. where applicable, the internet address at which the EU declaration of conformity can be accessed;

6. 適用時，可取得歐盟符合性聲明之網址；

7. the type of technical security support offered by the manufacturer and the end-date of the support period during which users can expect vulnerabilities to be handled and to receive security updates;

7. 製造商所提供之技術安全支援類型，及使用者可預期弱點處理與接收安全更新之支援期間結束日期；

8. detailed instructions or an internet address referring to such detailed instructions and information on:

8. 詳細說明或指向該等詳細說明之網址，及關於下列各項之資訊：

(a) the necessary measures during initial commissioning and throughout the lifetime of the product with digital elements to ensure its secure use;

(a) 為確保安全使用，於初始部署與具數位元素產品整個生命週期內之必要措施；

(b) how changes to the product with digital elements can affect the security of data;

(b) 對具數位元素產品之變更如何影響資料安全；

(c) how security-relevant updates can be installed;

(c) 如何安裝安全相關之更新；

(d) the secure decommissioning of the product with digital elements, including information on how user data can be securely removed;

(d) 具數位元素產品之安全下架，含如何安全移除使用者資料之資訊；

(e) how the default setting enabling the automatic installation of security updates, as required by Part I, point (2)(c), of Annex I, can be turned off;

(e) 依附件一第一部分第 (2)(c) 點所要求啟用自動安裝安全更新之預設設定，如何關閉；

(f) where the product with digital elements is intended for integration into other products with digital elements, the information necessary for the integrator to comply with the essential cybersecurity requirements set out in Annex I and the documentation requirements set out in Annex VII.

(f) 具數位元素產品擬整合進其他具數位元素產品時，整合商為符合附件一基本網路安全要求與附件七文件要求所需之資訊。

9. If the manufacturer decides to make available the software bill of materials to the user, information on where the software bill of materials can be accessed.

9. 製造商若決定向使用者提供軟體物料清單，有關軟體物料清單可於何處取得之資訊。

Important: Item 9 is optional — CRA does not mandate public SBOM disclosure to users. Annex VII item 2(b), however, requires the SBOM in the technical file. Annex I Part II (2) also requires the manufacturer to identify and document components contained in the product. What is mandatory to the regulator is optional to the end user.

重要：項次 9 為選擇性，CRA 並未強制向使用者公開 SBOM。惟附件七項次 2(b) 要求 SBOM 置於技術檔案中。附件一第二部分 (2) 也要求製造商辨識並記載產品所含之元件。對監管者強制、對終端使用者選擇性。

Article 13(18): The information and instructions shall accompany the product in paper or electronic form, in a language understood by users and market surveillance authorities, and shall be clear, understandable, intelligible, and legible. Manufacturers shall keep them available for at least 10 years after placing on the market or for the support period, whichever is longer. When provided online, they shall be accessible, user-friendly, and online-available for the same floor period.

第 13(18) 條：資訊與說明應以紙本或電子形式隨產品附帶，以使用者與市場監督機關易懂之語言，並應清晰、易懂、可解、可讀。製造商應於投放市場後至少 10 年或支援期間（取較長者）內維持可用。線上提供者，應可存取、友善、線上可用至相同底線期。

Article 13(19): The end-date of the support period (at least month and year) shall be clearly specified at the time of purchase in an easily accessible manner and, where applicable, on the product, its packaging, or by digital means. Where technically feasible, users shall be notified when the product reaches end-of-support.

第 13(19) 條：支援期間結束日期（至少月與年）應於購買時以易於取得之方式清楚載明，並於適用時載於產品本身、包裝或以數位方式提供。於技術可行時，產品到達支援期結束時應通知使用者。

Article 13(20): The manufacturer shall provide either the full EU declaration of conformity or a simplified declaration (Annex VI template) with the product. If simplified, it must contain the exact URL to the full DoC.

第 13(20) 條：製造商應隨產品提供完整歐盟符合性聲明或簡化聲明（附件六模板）。如為簡化，其須載明連至完整 DoC 之確切網址。