Manufacturer
The manufacturer is the central role in the Regulation. The product requirements, documentation, conformity assessment and reporting obligation all attach to it. Who the manufacturer is depends not on who makes the product but on whose name is on it.
The manufacturer is whoever develops or manufactures a product with digital elements, or has it developed or manufactured, and markets it under its own name or trademark. The role attaches to the name on the product, not to whoever wrote the code.
Definition in the Regulation
Article 3, point (13), of Regulation (EU) 2024/2847 defines the manufacturer as "a natural or legal person who develops or manufactures products with digital elements or has products with digital elements designed, developed or manufactured, and markets them under its name or trademark, whether for payment, monetisation or free of charge". The manufacturer's obligations are set out in Article 13, the reporting obligation in Article 14.
The Commission guidance C(2026) 5252 of 27 July 2026 contains no specific rule for commissioned development; it uses the notion of primary control over development, releases and distribution only for open-source software (paragraph 49). Article 3, point (13) remains decisive: if an agency develops software to a client's specifications and the client markets it under its own name, the client is the manufacturer and the agency a service provider. A contract can set out who develops the product and under whose name it appears, but the manufacturer role follows from these facts, not from a label in the contract. Responsibility cannot be handed off, not even to subcontractors (the Commission's Blue Guide 2022, section 3.1).
What it means for manufacturers
If you sell bought-in software or hardware under your own brand, you are the manufacturer with all the obligations, even if you have not written a single line of code. The same applies to importers and distributors who relabel or substantially modify a product (Article 21). A machinery manufacturer that integrates a bought-in controller into its plant is the manufacturer of the plant; for the controller, its due diligence obligation under Article 13(5) applies. The reporting obligation under Article 14 has applied to manufacturers since 11 September 2026, the other obligations under Article 13 apply from 11 December 2027.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitRelated terms
- Authorised representative
- Importer
- Distributor
- Change of role
- Due diligence for third-party components