Regulations

Manufacturer, importer, distributor under the CRA — who is responsible for what

How the CRA splits obligations between economic operators, and when an importer or distributor becomes a manufacturer under the regulation.

Michał Jaśniewski October 24, 2026 8 min read

The CRA assigns obligations not to companies but to the roles a company plays in relation to a specific product — and one company can play different roles for different products at the same time. The manufacturer is responsible for substantive conformity: the essential requirements, the risk assessment, the technical documentation, vulnerability handling and the Article 14 notifications. The importer verifies that the manufacturer has done its job and keeps the evidence. The distributor checks the marking and documents and acts when it knows about non-conformity. The most important provisions, though, are Articles 21 and 22: placing a product on the market under your own brand, or substantially modifying it, transfers the full manufacturer obligations to you — reporting clocks included.

The definitions decide everything else

Article 3 settles which role applies and leaves no room for choice.

Manufacturer (Article 3(13)) — a person or entity that develops or manufactures products with digital elements, or has them designed, developed or manufactured, and markets them under its own name or trademark. Payment is irrelevant: the definition covers products that are paid for, monetised, or provided free of charge.

Importer (Article 3(16)) — a person or entity established in the Union that places on the market a product bearing the name or trademark of a person or entity established outside the Union.

Distributor (Article 3(17)) — a person or entity in the supply chain, other than the manufacturer or the importer, that makes a product available on the Union market without affecting its properties.

Authorised representative (Article 3(15)) — a person or entity established in the Union that has received a written mandate from a manufacturer to act on its behalf in relation to specified tasks.

Open-source software steward (Article 3(14)) — a legal person, other than a manufacturer, whose purpose or objective is to systematically provide sustained support for the development of specific open-source products intended for commercial activities.

Two further definitions fix the moment the obligations kick in: placing on the market (Article 3(21)) is the first making available of a product on the Union market, and making available on the market (Article 3(22)) is any supply of a product for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge.

Manufacturer: the full burden

Article 13 has 25 paragraphs and is the most extensive catalogue of obligations in the regulation. The core:

On top of that comes Article 14 — the 24 h / 72 h / 14-day-or-one-month notifications (deadlines explained). This obligation rests solely on the manufacturer (and, from 11 December 2027, on open-source software stewards under Article 24(3)).

Importer: verification and records

The importer is not responsible for how the product is built. It is responsible for having checked.

Article 19(2) lists what it confirms before placing the product on the market: that the manufacturer has carried out the conformity assessment under Article 32 and drawn up the technical documentation; that the product bears the CE marking and is accompanied by the EU declaration of conformity and by the information and instructions in Annex II, in a language easily understood by users and authorities; and that the manufacturer has complied with Article 13(15), (16) and (19) (product identification, contact details, the end date of the support period). The importer must be able to produce the documents supporting these findings.

Next: if the importer considers, or has reason to believe, that the product or the manufacturer’s processes do not conform, it does not place the product on the market until conformity is ensured (paragraph 3). Where the product presents a significant cybersecurity risk, it informs the manufacturer and the market surveillance authorities; where the risk stems from non-technical factors, only the authorities.

After placing on the market: immediate corrective action in the event of non-conformity, informing the manufacturer of any vulnerability without undue delay, and immediately informing the authorities of every Member State where the product has been made available when there is a significant risk (paragraph 5).

Records: a copy of the EU declaration of conformity for 10 years after placing on the market, or for the support period if longer, and ensuring the technical documentation can be made available to authorities on request (paragraph 6).

The importer also puts its own name and contact details on the product, its packaging or an accompanying document (paragraph 4) — and those details, not the third-country manufacturer’s, will be the authority’s first port of call.

Distributor: due care, not an audit

Article 20(1) sets the standard as acting with due care in relation to the requirements of the regulation. It is not an obligation of result.

The scope of verification is narrow and listed in paragraph 2: the CE marking on the product, and confirmation that the manufacturer and the importer have complied with Article 13(15), (16), (18), (19) and (20) and Article 19(4), and have provided the distributor with the necessary documents.

The required responses, however, are real. Where the distributor considers, or has reason to believe, that the product or the manufacturer’s processes do not meet the essential requirements of Annex I, it does not make the product available until conformity is ensured, and in case of a significant risk informs the manufacturer and the market surveillance authorities without undue delay (paragraph 3).

After making the product available: ensuring corrective measures are taken or the product is withdrawn, informing the manufacturer of any vulnerability it becomes aware of, and immediately informing the authorities of the Member States where the product has been made available when there is a significant risk (paragraph 4).

Article 20 contains no incident reporting obligation. The distributor is not on the Article 14 clock — unless it changes role.

When an importer or distributor becomes the manufacturer

Article 21 is the provision with the biggest financial consequences in the whole of Chapter II. An importer or distributor is treated as the manufacturer, and is subject to Articles 13 and 14, when it:

  1. places the product on the market under its own name or trademark, or
  2. carries out a substantial modification of a product already placed on the market.

Article 22 extends this to anyone else: a natural or legal person other than the manufacturer, importer or distributor that substantially modifies a product and makes it available on the market is subject to the obligations of Articles 13 and 14 for the part of the product affected by the modification — and, if the modification affects the cybersecurity of the product as a whole, for the entire product.

A substantial modification (Article 3(30)) is a change after placing on the market that affects compliance with the essential requirements in Annex I Part I, or changes the intended purpose for which the product was assessed.

Three scenarios where companies misread their own role

White label. A software house resells someone else’s product under its own brand. That is not distribution — it is manufacturing within the meaning of Article 3(13) and Article 21. All of Article 13 and all of Article 14 apply, technical documentation and conformity assessment included.

An integrator making its own modifications. An implementation partner adapts a product at a customer site. If the change affects compliance with the essential requirements or changes the intended purpose, Article 22 transfers manufacturer obligations — at least for the modified part.

One company, several product lines. A company makes its own software (manufacturer), resells devices from a US supplier (importer) and brokers licences for a European vendor (distributor). The obligations don’t merge into one set, and you don’t get to pick the lightest one — each product carries its own set, determined by your role in relation to it.

The practical first step is always the same: a product register with an assigned role and the reasoning behind each assignment. Without it you can estimate neither the scope of the documentation nor who picks up a vulnerability report at two in the morning.

Sources

For information only, not legal advice. This article covers the technical and process layer of the obligations under Regulation (EU) 2024/2847; full compliance also requires organizational and legal work on your side and does not replace legal advice or a formal conformity assessment. Current as of October 2026.

CRARolesCompliance