Key takeaways
- Most CRA guidance is written for the company that designs a product.
- An importer is the entity in the EU that first places a product manufactured outside the Union on the EU market.
- The manufacturer ran the right conformity assessment procedure for the product's class, per Article 32.
- A distributor's position is one step further removed, but the CRA still requires it to act with due care, not simply resell.
Most CRA guidance is written for the company that designs a product. But a distributor restocking a PLC, an importer bringing a camera line into the EU, or a reseller who puts its own badge on an OEM gateway all carry their own, separate duties under the Cyber Resilience Act, Regulation (EU) 2024/2847. None of these roles can simply assume "the manufacturer handles compliance" — each has a checkable obligation before the product moves further down the chain, and under specific conditions either one can end up holding the full manufacturer obligation itself.
Four roles, four articles
Chapter II of the CRA sets obligations for each economic operator separately:
| Role | Article | Core duty |
|---|---|---|
| Manufacturer | Art. 13 | Design, build, document and support the product under Annex I |
| Authorised representative | Art. 18 | Act on a non-EU manufacturer's behalf for EU market-surveillance contact |
| Importer | Art. 19 | Check the manufacturer's conformity work before placing the product on the market |
| Distributor | Art. 20 | Check CE marking and manufacturer/importer compliance before making the product available |
An importer is the entity in the EU that first places a product manufactured outside the Union on the EU market. A distributor is anyone further down the supply chain, other than the manufacturer or importer, who makes the product available without altering it.
What an importer must do (Article 19)
Before placing a product with digital elements on the EU market, an importer must ensure that:
The manufacturer ran the right conformity assessment procedurefor the product's class, per Article 32. Technical documentation existsThe importer does not need to hold the full file itself, but must be able to show it was produced. The manufacturer's own identification duties were met— Article 13(15), (16) and (19), covering the CE marking, the EU declaration of conformity, and the name, registered trade name and contact details on the product, its packaging or accompanying documentation. The product is not already known to be non-compliantAn importer cannot place a product on the market if it knows or has reason to believe it does not meet the Annex I essential requirements.
If an importer later learns of a non-conformity, Article 19 requires it to take corrective action, or to withdraw or recall the product if that is what it takes to fix it. If it becomes aware of a vulnerability in the product, it must tell the manufacturer without undue delay. Importers must also keep the documents needed to show this checking was done, and cooperate with market surveillance authorities on request.
What a distributor must do (Article 20)
A distributor's position is one step further removed, but the CRA still requires it to act with due care, not simply resell. Before making a product available, a distributor must verify:
- The CE marking is present.
- The manufacturer and importer have each met their own identification obligations (Article 13(15), (16), (18), (19) and (20), and Article 19(4)) — contact details, support-period disclosure, CE marking and declaration of conformity among them.
- It holds, or can obtain, the documents needed to demonstrate this.
While the product is in its possession, a distributor must make sure storage and transport conditions do not compromise its compliance — relevant for anything stored for resale, including firmware-bearing hardware sitting in a warehouse. Like an importer, a distributor must stop supplying a product it has reason to believe is non-compliant, tell the manufacturer about any vulnerability it discovers, and cooperate with market surveillance authorities in a language they can understand.
When you become the manufacturer instead (Articles 21 and 22)
The CRA has a specific trigger that converts an importer or distributor into a full manufacturer, carrying the Article 13 and Article 14 obligations — design requirements, SBOM, vulnerability handling and 24-hour reporting included. Under Article 21, this happens when an importer or distributor:
- Places a product on the market under its own name or trademark, or
- Carries out a substantial modification of a product already placed on the market.
Article 22 extends the same rule to anyone outside the manufacturer/importer/distributor chain who substantially modifies a product and makes it available. The CRA's own definition of substantial modification is a post-market-placement change that affects compliance with the Annex I Part I essential requirements, or that changes the intended purpose the product was originally assessed against.
In practice, this reclassification is the sharpest risk for private-label resellers, systems integrators and value-added distributors:
| Action | Typical effect |
|---|---|
| Reselling, repackaging without changing firmware or function | Stays a distributor |
| Putting your own brand/trademark on an OEM device, no functional change | Becomes the manufacturer (Art. 21) |
| Pre-installing software, changing firmware configuration that affects the essential requirements | Likely a substantial modification — becomes the manufacturer |
| Bundling components into a new product placed on the market under your name | Treated as manufacturer of the resulting product |
Because this trigger does not depend on whether you were involved in the original design, it is easy to cross without noticing — a private-label contract that looks purely commercial can carry full CRA manufacturer liability with it.
What importers and distributors should do now
Map every product line by role, not by company department: for each SKU, know whether you act as manufacturer, importer or distributor under the CRA, since the same company can be different roles for different product lines. Build a documentation-request routineinto procurement: ask every upstream manufacturer for the CE marking, declaration of conformity reference, and confirmation of their CRA vulnerability-handling process before the first shipment, not after a market surveillance request. Flag private-label and OEM-rebadge deals for legal review before signingIf your name or trademark goes on the box, assume Article 21 applies and budget for manufacturer-level technical documentation and reporting. Check any planned firmware customisation or configuration changeagainst the definition of substantial modification before shipping it, since a configuration change affecting the essential requirements is enough to trigger Article 21, even without touching the hardware. Set up your own vulnerability-forwarding contactArticles 19 and 20 both require telling the manufacturer about a vulnerability without undue delay — that only works if someone owns the intake.
For the manufacturer-side obligations this guide's roles check against, start with the CRA checklist for device makers and CRA Annex I explained. If your own firmware customisation might cross into a substantial modification, SoftWSP can build the SBOM and vulnerability report your rebadged or modified product would need: see device firmware security.
This guide is general information, not legal advice.
Sources
Frequently asked questions
Does the Cyber Resilience Act apply to importers and distributors, or only manufacturers?
All three. Regulation (EU) 2024/2847 sets separate duties for manufacturers (Article 13), authorised representatives (Article 18), importers (Article 19) and distributors (Article 20), within the same Chapter II on obligations of economic operators. Importers and distributors are not expected to redo the manufacturer's design and testing work, but each has an independent, checkable duty before the product reaches the next link in the chain.
What must an importer check before placing a product with digital elements on the EU market?
Per Article 19, before placing a product on the market an importer must ensure the manufacturer carried out the appropriate conformity assessment procedure (Article 32), drew up the technical documentation, and met the obligations in Article 13(15), (16) and (19), which cover the CE marking, the EU declaration of conformity, and identification information on the product or its packaging. The importer must also be able to provide documents proving this was checked, and must inform the manufacturer, without undue delay, of any vulnerability it becomes aware of in the product.
What must a distributor check before making a product available?
Per Article 20, a distributor must act with due care and, before making a product available, verify the CE marking is present and that the manufacturer and importer have each complied with their own obligations, including the identification requirements in Article 13(15), (16), (18), (19) and (20) and Article 19(4). While a product is in its possession, a distributor must also ensure storage and transport conditions do not compromise its compliance, and it must inform the manufacturer of any vulnerability it becomes aware of.
When does an importer or distributor become a manufacturer under the CRA?
Under Article 21, an importer or distributor is considered to be a manufacturer, and takes on the Article 13 and Article 14 manufacturer duties, if it places a product with digital elements on the market under its own name or trademark, or carries out a substantial modification of a product already on the market. Article 22 extends the same rule to any other person, outside the manufacturer/importer/distributor chain, who substantially modifies a product and makes it available. The CRA defines substantial modification as a change made after the product was placed on the market that affects its compliance with the Annex I Part I essential requirements, or that changes the intended purpose the product was originally assessed against.
What should an importer or distributor do if it finds a non-compliant or vulnerable product?
Both Article 19 and Article 20 require the economic operator to stop: an importer that knows or has reason to believe a product it placed on the market is not in conformity must take corrective action, withdraw, or recall it, and a distributor must not make a non-compliant product available until it has been brought into conformity. Both must inform the manufacturer of a discovered vulnerability without undue delay, and both must cooperate with market surveillance authorities on a reasoned request.
In this cluster
