Distributor
The distributor resells what others have manufactured or imported. The Regulation does not require it to test the product itself, but it does have to check the marking, the documents and the support end date.
A distributor is anyone in the supply chain who makes a product with digital elements available on the market without being its manufacturer or importer. Specialist retailers, IT systems integrators and resellers typically fall into this role.
Definition in the Regulation
Article 3, point (17), of Regulation (EU) 2024/2847 defines the distributor as "a natural or legal person in the supply chain, other than the manufacturer or the importer, that makes a product with digital elements available on the Union market without affecting its properties". Its obligations are set out in Article 20. Paragraph 1 requires due care. Paragraph 2 lists what must be checked before making the product available: the CE marking, the manufacturer's identification details and contact information, the user information, the end date of the support period, the accompanying EU declaration of conformity and the importer's contact details. Paragraph 3: if the distributor has reason to believe that the product does not conform, it must not make it available. Paragraph 4: if it becomes aware of a vulnerability, it informs the manufacturer without undue delay and, where there is a significant risk, also the market surveillance authorities. Paragraph 6: if it learns that the manufacturer has ceased operations, it informs the authorities and users.
What it means for manufacturers
Manufacturers must give their distributors what the distributors have to check: the declaration of conformity, user information and a visible support end date. If anything is missing, the distributor may not sell the product. Conversely, the distributor is a source of vulnerability reports for the manufacturer: if a retailer hears about a flaw from a customer, Article 20(4) requires it to pass this on to the manufacturer. Anyone who sells someone else's product under their own brand is no longer a distributor but, under Article 21, a manufacturer. According to recital 78, online marketplaces that only act as intermediaries are not distributors; if they sell products themselves, they are. The distributor obligations apply from 11 December 2027.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit