Cyber Resilience Act Response Center Request a demoDemo

Guide Last updated 15 min read

The CRA for agencies and custom software: who is the manufacturer and who is not

An agency that develops to a client's specification is a service provider. It becomes a manufacturer as soon as it sells its own plugin, theme or product under its own name. This page sorts out the typical cases, from client websites to off-the-shelf software, and shows what belongs in contracts.

Under Article 3, point (13) of Regulation (EU) 2024/2847, the manufacturer is the person or company that develops a product with digital elements, or has one developed, and markets it under its own name or trademark. By this definition, an agency that develops to a client's specification is a service provider, and the manufacturer is the client that markets the product under its own name. The agency itself becomes a manufacturer as soon as it sells its own plugin, theme or product. Websites and purely online services are not products (recital 12). Software that a company develops itself for its own operations and does not pass on is not made available on the market; where custom software is supplied to a client for payment, the BSI and the European Commission take the view that it is made available, even if it is a single copy.

Key points

  • The manufacturer is whoever develops a product, or has it developed, and markets it under its own name (Article 3, point (13)).
  • Agency working to the client's specification: service provider. Client marketing the product under its own name: manufacturer (Article 3, point (13), second alternative).
  • Own plugin, theme or app, sold more than once: the agency is a manufacturer with all the obligations; the reporting obligation has applied since 11 September 2026.
  • Websites and purely online services are not products (recital 12); NIS2 may apply to them.
  • An open-source plugin outside any commercial activity stays out of scope. A price, a paid tier or processing of personal data as a condition of use brings it in (Article 3, point (22), recitals 15 and 18).

Who is the manufacturer under Article 3, point (13)?

The Regulation recognises two routes to the manufacturer role: developing the product yourself and marketing it under your own name, or having it designed, developed or manufactured and marketing it under your own name. The second route is commissioned development: whoever commissions the work and offers the result as its own product is the manufacturer, without having written a single line itself. Both routes require the product to be made available on the market, which under Article 3, point (22) means in the course of a commercial activity, whether for payment or free of charge. Recital 15 lists the indicators: a price, charging for support beyond cost recovery, an intention to make a profit, processing of personal data as a condition of use.

The Commission guidance C(2026) 5252 of 27 July 2026 (not legally binding) does not address commissioned development explicitly. It uses the idea of control for open source: the party responsible is whoever publishes the software and has primary control over its development, releases and distribution (paragraph 49). For remote data processing it makes clear that software built by a service provider to the manufacturer's instructions and specifications is developed under the manufacturer's responsibility (paragraph 195).

Commissioned development: the agency as service provider, the client as manufacturer

If an agency develops to the client's specification and the client places the result on the market under its own name, the client is the manufacturer. The agency is a supplier with no obligations of its own under Articles 13 and 14, but the manufacturer needs it for the software bill of materials and for fixing vulnerabilities. The manufacturer role depends on marketing under one's own name or trademark (Article 3, point (13)), not on what the contract calls the parties. A contract can set out who does the work, who supplies which documents and under whose name the product appears. The manufacturer role, however, follows from these facts, not from a label in the contract, and responsibility cannot be handed off as far as market surveillance is concerned: according to the Commission's Blue Guide, a manufacturer that subcontracts work may in no case pass its responsibility on to the subcontractor (section 3.1).

If the client only uses the software itself

If a company develops software itself for its own operations and does not pass it on, there is no supply to anyone else; the software is not made available on the market (Article 3, point (22)). The Commission services' FAQ says so for tools that a manufacturer develops for its own use (question 1.5). If, on the other hand, a software house supplies custom software to a client for payment, the BSI and the European Commission agree that it is made available on the market. The BSI's CRA FAQ explicitly names one-off products and custom software, regardless of the number of units and general availability. The Commission services' FAQ treats software developed for the needs of a specific business user as a tailor-made product that may deviate from only two requirements (question 4.2.5), and the guidance treats source code that a company licenses to a client for an internal platform as placed on the market (Example 7). This fits the wording: Article 3, point (22) covers supply "for distribution or use", not only for onward distribution (guidance, paragraph 10), and making available refers to each individual copy (guidance, paragraph 11). The guidance and the FAQ are not legally binding; only the Court of Justice of the European Union can give a binding interpretation. In this case the manufacturer is usually the software house, because a client that only uses the software internally does not market anything under its own name. It has not been settled who the manufacturer is when the software runs under the client's name or is created under the client's direction and control. Anyone supplying custom software should therefore record in the contract under whose name it is supplied and who handles and reports vulnerabilities. If it is later passed on or becomes part of a product, it is covered in any case.

For tailor-made products supplied to business users, the Regulation allows deviations for the secure by default configuration (Annex I, Part I, point (2)(b)) and for free security updates (Annex I, Part II, point (8), recital 64). Vulnerability handling itself remains mandatory.

When is the agency itself the manufacturer?

As soon as it markets a product under its own name: a plugin for a content management system, a theme, an app or a library, sold more than once or offered free of charge as part of the business. Article 3, point (1) explicitly includes software components placed on the market separately in the definition of a product; a plugin is installed on the client's system, unlike a website. The number of copies is irrelevant. A company that sells third-party software under its own brand (Article 21), or substantially modifies a third-party product and makes it available (Article 22), is also a manufacturer.

As a manufacturer, the agency bears all the obligations under Article 13 and Annex I from 11 December 2027: cybersecurity risk assessment, software bill of materials, a support period of at least five years, a contact address for vulnerabilities, documentation, CE marking. The reporting obligation under Article 14 has applied since 11 September 2026 and, under Article 69(3), also covers plugins that have been in circulation for years. Most plugins fall into the default category; one whose core functionality is login, single sign-on or password management can fall under Annex III, class I and then, without a harmonised standard, needs a notified body (Article 32(2)). For an overview, see Manufacturer obligations under Article 13 CRA.

Websites and purely online services

A website that an agency builds for a client is not a product with digital elements. Recital 12 excludes websites that do not support the functionality of a product and refers software as a service to the NIS2 Directive. According to the guidance, an application that runs only in the browser is not a product either (paragraph 21, Example 5). A product is what the user downloads or installs and what runs on their system: an app, a desktop client, a browser extension, a plugin (paragraph 20).

One exception: if the agency builds the client an app with a back end without which the app would lose a function, the back end is remote data processing under Article 3, point (2). It is then part of the client's product, because it was developed under the client's responsibility; the agency that operates it is a service provider (guidance, paragraphs 195 and 196). Details in SaaS, cloud and remote data processing.

Open-source plugins and monetisation

Many agencies publish plugins as free and open-source software within the meaning of Article 3, point (48). According to recital 18, such software only falls within scope if it is made available in the course of a commercial activity. A plugin with no price, no paid tier and no processing of personal data as a condition of use stays out of scope; donations that do no more than cover costs make no difference (recital 15). The lighter regime for open-source software stewards (recital 19) applies only to legal persons that support projects on a sustained basis.

According to the guidance, besides charging a price there are three further cases in which a product is made available on the market: where access to a version together with technical assistance or performance optimisation is tied to a fee (paragraph 57), where the plugin serves as a platform for selling other services, or where personal data are processed as a condition of use (paragraph 54). Consulting, training or support offered separately do not make it commercial (paragraphs 55 and 56). Anyone who installs and maintains third-party open source for a client does not place it on the market, as long as they do not substantially modify it in the process (paragraph 59, Example 19). With a "free version plus pro version" model, the pro version is therefore a product. According to the guidance, the free version is a separate product that is not placed on the market; an agency that is a legal person bears the obligations of an open-source software steward under Article 24 for it (paragraphs 52 and 53). More in Open source and the CRA.

What belongs in contracts

The manufacturer role cannot be negotiated away, but the work behind it can be allocated. Five points belong in every development and maintenance contract:

  • Role. Who is the manufacturer under Article 3, point (13), and who is the supplier? Derived from who markets the product.
  • Vulnerability handling. Who fixes vulnerabilities during the support period under Article 13(8), how quickly and at what cost? It must be possible to provide security updates separately from functionality updates (Annex I, Part II, point (2)), and they must be free of charge for users (point (8)). The end of a maintenance contract does not end the support period.
  • Components. Who maintains the software bill of materials (Annex I, Part II, point (1)), who checks libraries under Article 13(5), and who reports findings to their manufacturers (Article 13(6))?
  • Reporting route. Who operates the contact address for vulnerabilities (Article 13(17))? If the agency learns that the client's product is being exploited, the manufacturer has to know immediately, because its 24-hour deadline starts when it becomes aware. The manufacturer submits the notification; what a service provider can take on is explained in Outsourcing the CRA reporting obligation.
  • Documentation and source code. Keep the technical documentation for ten years (Article 13(13)) and keep every security update available for ten years (Article 13(9)). Both require access to the source code and the build environment, including after the working relationship ends.

Four cases at a glance

CaseRoleObligations
Agency builds a website for a clientNot a product (recital 12). The agency is a service provider, the client is the operator.No obligations under the CRA. NIS2 may apply to the operator.
Agency sells its own plugin or themeThe agency is the manufacturer (Article 3, point (13)); its customers are users.Article 13 and Annex I from 11 December 2027; reporting obligation under Article 14 since 11 September 2026.
Software house supplies custom software to a clientIf the client markets the software, the client is the manufacturer and the software house a supplier. If the client only uses it internally, the BSI and the Commission regard supply for payment as making available on the market (BSI FAQ, Commission services' FAQ, question 4.2.5, guidance Example 7); the manufacturer is then usually the software house.Where the client markets the software: all manufacturer obligations lie with the client. Where it is used internally: the manufacturer obligations lie with the software house; for tailor-made products, agreed deviations from two requirements are possible (Annex I). Seek legal advice on borderline cases (client's name on the software, development under the client's control).
Software house sells off-the-shelf softwareManufacturer.All obligations under Articles 13, 14 and Annex I; check the product class under Annex III.

For agencies and software houses that are manufacturers, or that carry this role operationally for clients, CRA Response Center provides readiness for Article 14 as a service. The tool monitors the security mailbox, recognises important reports, notifies the people responsible by SMS and e-mail, and records awareness and deadlines in the history. The decision and the submission remain with the manufacturer.

Checklist for agencies and software houses

  • List your own products. Plugins, themes, apps and libraries under your own name, with versions and distribution; the reporting obligation has applied to them since 11 September 2026.
  • Check monetisation. For open-source plugins: is there a pro version, a paid tier, processing of data as a condition of use? If so, there is a commercial activity.
  • Check the class. Does one of your own products have a function from Annex III as its core functionality?
  • Update your contracts. Settle the role, vulnerability handling, the bill of materials, the reporting route, documentation and access to source code.
  • Set up a reporting address. For your own products, a mailbox and security.txt; for client products, define the route to the manufacturer.
  • Record awareness. Note the time and source of every report and inform the manufacturer immediately.
Free toolsecurity.txt generatorFor your own products and for clients: create a security.txt to RFC 9116 or BSI TR-03183-3, with a check and a draft CVD policy.Create the file Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit

Frequently asked questions

We only ever develop on commission. Are we a manufacturer?

That depends on what the client does with the software. The manufacturer is whoever has the product developed and markets it under its own name (Article 3, point (13)). If your client markets the result, the client is the manufacturer and you are a supplier. If you supply custom software for payment to a client that only uses it internally, the BSI and the Commission regard this as making it available on the market (BSI FAQ on the CRA, Commission services' FAQ, question 4.2.5, guidance Example 7); in that case you are usually the manufacturer. Seek legal advice on borderline cases, for example where the software runs under the client's name.

We have a plugin that 2,000 customers have bought. What applies?

You are the manufacturer. The reporting obligation under Article 14 has applied since 11 September 2026 to all versions in circulation (Article 69(3)); Annex I, documentation and CE marking apply to versions placed on the market from 11 December 2027.

Is a client website a product with digital elements?

No. Recital 12 excludes websites that do not support the functionality of a product. A back end without which a client's app does not work is different: that is remote data processing under Article 3, point (2) and part of the product.

Our open-source plugin is free, but we sell support. Are we in scope?

According to the guidance, not for that reason alone (paragraphs 55 and 56, Example 18). Support offered separately does not make a plugin commercial. It is different with a paid version that unlocks features, or where access to the software together with maintenance is tied to a fee (recital 15, guidance paragraph 57).

Can the contract specify that the agency is the manufacturer?

Not just by calling it that. The contract can allocate the work and determine under whose name the product appears. The role then follows from these facts, above all from marketing under one's own name (Article 3, point (13)). According to the Commission's Blue Guide, a manufacturer cannot pass on its responsibility, not even to a subcontractor (section 3.1).

Further reading

Sources

The reporting obligation already applies. Who answers at night at your company?

CRA Response Center monitors your security mailbox, recognises important reports using AI hosted in Germany (your e-mails never go to OpenAI, Anthropic or Google) and alerts your people by SMS and e-mail. EUR 190 per month including VAT. Try it free for 30 days.

Try it free for 30 days