Change of role
Roles in the supply chain are not fixed. If you relabel someone else's product or substantially modify it, you take on the manufacturer's obligations, including the reporting obligation.
A change of role means that an importer, distributor or other third party is considered to be the manufacturer because it markets a product under its own name or has substantially modified it. All the obligations change hands along with the role.
Definition in the Regulation
Article 21 of Regulation (EU) 2024/2847 covers importers and distributors. They are considered to be manufacturers and are subject to Articles 13 and 14 if they place a product on the market under their own name or trademark. The same applies if they carry out a substantial modification of a product already placed on the market. Article 22(1) covers any other person who carries out a substantial modification and makes the product available on the market. Under Article 22(2), the obligations then apply to the part affected by the modification or, if the cybersecurity of the product as a whole is affected, to the entire product. As manufacturers, those concerned are subject to the higher range of fines under Article 64(2): up to EUR 15 million or 2.5 per cent of total worldwide annual turnover, applicable from 11 December 2027.
What it means for manufacturers
The most common case among small and medium-sized companies is the own brand: an IT systems integrator sells another company's firewall under its own name and thereby becomes the manufacturer of an important product in class II. Self-assessment is not enough for this, not even with harmonised standards; a notified body or a European cybersecurity certificate is required (Article 32(3)). Whether the original manufacturer's certificate is sufficient or whether it has to be issued in the name of the own-brand manufacturer is an open question to be clarified with the notified body. The second case is modification: if you add a remote connection to a product or change its intended purpose, you place it on the market anew and bear the obligations for that part. A pure security fix does not trigger a change of role. Whoever changes role also takes on the reporting obligation under Article 14 and needs a reporting address, a call chain and access to the single reporting platform.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit