Cyber Resilience Act Response Center Request a demoDemo

Guide Last updated 12 min read

Importers, distributors and authorised representatives: obligations under Articles 18 to 22 CRA

The Cyber Resilience Act does not only place obligations on manufacturers. Anyone who brings products from third countries into the EU or resells them must check, keep records and pass vulnerabilities on. Anyone who puts their own logo on a product or substantially modifies it becomes a manufacturer.

Besides the manufacturer, the Cyber Resilience Act recognises three further roles: the authorised representative (Article 18), the importer (Article 19) and the distributor (Article 20). Importers and distributors check whether the manufacturer has met its obligations, keep evidence and pass vulnerabilities on to the manufacturer without undue delay. Anyone who sells a product under their own brand or substantially modifies it is considered a manufacturer under Articles 21 and 22, with all the obligations that entails, including the reporting obligation.

Key points

  • An importer places a product from a manufacturer established outside the Union on the EU market (Article 3, point (16)). A distributor makes it available in the supply chain without being the manufacturer or the importer (Article 3, point (17)).
  • Importers check the conformity assessment, documentation, CE marking, accompanying information and the end-of-support date (Article 19(2)). Distributors check what is visible (Article 20(2)).
  • Vulnerabilities go to the manufacturer without undue delay and, where there is a significant cybersecurity risk, also to market surveillance authorities (Article 19(5), Article 20(4)).
  • An own brand or a substantial modification turns an importer or distributor into a manufacturer (Article 21); the same applies to any other party making a substantial modification (Article 22).
  • From 11 December 2027, infringements of Articles 18 to 23 can cost up to EUR 10 million or 2 per cent of worldwide annual turnover (Article 64(3)).

Who is an importer, a distributor or an authorised representative?

The Regulation groups all those involved together as economic operators (Article 3, point (12)). The role does not depend on the contract but on what a company actually does with the product.

  • An importer is a person established in the Union who places on the market a product with digital elements bearing the name or trademark of a person established outside the Union (Article 3, point (16)). Example: a German distributor importing industrial routers from an Asian manufacturer.
  • A distributor is anyone in the supply chain who makes a product available on the market without affecting its properties, other than the manufacturer or the importer (Article 3, point (17)). Example: a specialist dealer reselling those routers to businesses.
  • An authorised representative is a person or company established in the EU that a manufacturer has mandated in writing to perform specified tasks on its behalf (Article 18(1)). Appointing one is an option, not an obligation.

A company that builds a bought-in control unit into its own machine is none of these three; it is the manufacturer of the machine (with a due diligence obligation for the control unit under Article 13(5)). For the distinction, see Who is the manufacturer under the CRA?

What can an authorised representative take on, and what not?

Article 18(2) draws a clear line. The core obligations under Article 13(1) to (11), drawing up the technical documentation (first subparagraph of Article 13(12)) and conformity of series production (Article 13(14)) cannot be delegated. The risk assessment and the conformity assessment therefore remain with the manufacturer. Article 18(3) sets out what the authorised representative takes on as a minimum:

  • Keeping the EU declaration of conformity and the technical documentation at the disposal of market surveillance authorities for ten years or for the support period.
  • Providing evidence on a reasoned request from an authority.
  • Cooperating with the authorities on action taken to eliminate the risks posed by the product.

The authority can request a copy of the written mandate; an authorised representative without one is not an authorised representative. For manufacturers outside the EU, the authorised representative is often the only contact in the Union, see The CRA in Austria and Switzerland.

What must an importer check?

Article 19(1) requires importers to place only compliant products on the market: products that meet Annex I, Part I, and whose manufacturer has put vulnerability handling in place in accordance with Annex I, Part II. Before doing so, the importer ensures under Article 19(2) that:

  • The manufacturer has carried out the conformity assessment under Article 32.
  • The technical documentation has been drawn up.
  • The CE marking, the EU declaration of conformity and the information and instructions to the user under Annex II are provided, in a language users can understand.
  • The manufacturer has provided the identification details (Article 13(15)), contact details (Article 13(16)) and the end of the support period (Article 13(19)).
  • The evidence for this is available.

If in doubt about conformity, the importer does not place the product on the market (Article 19(3)); where there is a significant cybersecurity risk, it informs the manufacturer and the market surveillance authorities, and where non-technical risk factors are involved, it informs the market surveillance authorities, which then follow Article 54(2). In addition, there are ongoing obligations:

  • Its own contact details on the product, its packaging or the accompanying documents (Article 19(4)).
  • Keeping the declaration of conformity for ten years or for the support period, and being able to obtain the technical documentation on request (Article 19(6)).
  • Providing evidence on reasoned request (Article 19(7)).
  • Informing market surveillance authorities and users if the manufacturer ceases its operations (Article 19(8)).

What must a distributor check?

Under Article 20(1), the distributor must act with due care. It does not check the documentation but what is visible. Before making the product available, it verifies under Article 20(2) that:

  • The product bears the CE marking.
  • The manufacturer and the importer have provided their identification and contact details (Article 13(15) and (16), Article 19(4)).
  • The information and instructions to the user are included (Article 13(18)) and the end of the support period is stated (Article 13(19)).
  • The EU declaration of conformity is provided (Article 13(20)).
  • All documents required are supplied with the product.

If in doubt, the distributor does not make the product available; where there is a significant risk, it informs the manufacturer and the market surveillance authorities (Article 20(3)). It provides evidence on request (Article 20(5)) and informs the authorities and users if the manufacturer ceases its operations (Article 20(6)). Relying on the CE marking alone does not satisfy Article 20(2).

What happens when an importer or distributor learns of a vulnerability?

This is the obligation most likely to be overlooked in day-to-day business. Article 19(5) and Article 20(4) require importers and distributors to inform the manufacturer without undue delay when they become aware of a vulnerability in the product. Where there is a significant cybersecurity risk, they also inform the market surveillance authorities of the Member States in which the product has been made available, giving details of the non-compliance and of any corrective measures taken. In the case of non-compliance, both ensure that corrective measures are taken, up to withdrawal or recall.

In practice, this means a specialist dealer to whom a customer reports a flaw must not leave it sitting in its own ticket system. It must go to the manufacturer straight away, because the manufacturer's 24-hour deadline under Article 14 runs from awareness. The Regulation does not define what "significant" means, and the Commission guidance contains no examples for importers and distributors. Notification on the ENISA platform remains the manufacturer's job; the process is described in The first 24 hours after a vulnerability report.

When does an importer or distributor become a manufacturer?

Article 21 names two cases. An importer or distributor is considered a manufacturer and is subject to Articles 13 and 14 if it places a product on the market under its own name or trademark. The same applies if it carries out a substantial modification of a product already placed on the market. If an IT systems integrator sells a third-party firewall under its own brand, it takes on all the manufacturer's obligations: its own conformity assessment (for a firewall, as a class II product, with a notified body) and the reporting obligation under Article 14.

Article 22 extends this to any other person, such as integrators or service providers. Anyone who carries out a substantial modification and makes the product available on the market is considered a manufacturer (Article 22(1)). The obligations apply to the modified part or, if the cybersecurity of the product as a whole is affected, to the entire product (Article 22(2)). What counts as substantial is explained in Substantial modification: when an update makes a new product. Anyone who becomes a manufacturer in this way falls into the higher tier of fines, up to EUR 15 million or 2.5 per cent (Article 64(2)).

Which records does Article 23 require?

All economic operators must be able to tell market surveillance authorities, on request, from whom they obtained a product and to whom they supplied it, for ten years, including after a change of IT system.

Groups, marketplaces, fulfilment: the special cases

The EU subsidiary imports from its parent company

The CRA has no group privilege. If a German subsidiary imports its parent's products from a third country under the parent's brand, it is an importer with all the obligations under Article 19. If the brand belongs to the subsidiary, it becomes a manufacturer under Article 21. A common solution: the parent remains the manufacturer, and the subsidiary is appointed in writing as authorised representative under Article 18 while also acting as importer; the declaration of conformity and the technical documentation are then held in the EU.

Online marketplaces

Under recital 78, a pure intermediary service within the meaning of Regulation (EU) 2023/988 is not an economic operator under the CRA. If the marketplace sells products itself, it is a distributor; if it sells own-brand products, it is a manufacturer. Platform obligations are governed by the Digital Services Act and the General Product Safety Regulation.

Package managers and repositories

Under recital 20, providing software in open repositories is not placing on the market; operators are only distributors if they supply in the course of a commercial activity. More in Open source and the CRA.

Fulfilment service providers

The CRA does not name fulfilment service providers as a role of their own. Article 52(1) declares the Market Surveillance Regulation (EU) 2019/1020 applicable, and Article 66 adds the CRA to its Annex I. Article 4 of that Regulation, which requires an economic operator established in the EU and names the fulfilment service provider as a fallback, applies under its paragraph 5 only to the legal acts exhaustively listed there; the CRA is not among them in the consolidated version of 12 August 2026. On our reading, this means there is no obligation to have such a responsible economic operator for CRA products.

What this means in practice

  • Define the role for each product. The same company can be a distributor for one product, an importer for another and the manufacturer for its own brand.
  • A checklist at goods receipt with the points from Article 19(2) or Article 20(2), ticked off for each product type.
  • A route for vulnerabilities. Anyone in sales or service who receives a report must know which address at the manufacturer it goes to.
  • Keep supply chain records and declarations of conformity for ten years (Article 23, Article 19(6)).
  • Adjust contracts. Agree with manufacturers in third countries who obtains the documentation and how quickly vulnerabilities are passed on.

For importers and distributors that have become manufacturers under Article 21, the reporting obligation under Article 14 has applied since 11 September 2026. CRA Response Center monitors the security mailbox for them, alerts the people responsible when important reports come in and records awareness and deadlines in the history; the manufacturer submits the notification on the ENISA platform itself.

Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit

Frequently asked questions

Am I an importer or a distributor?

An importer if you place a product from a manufacturer outside the EU on the Union market under that manufacturer's brand (Article 3, point (16)). A distributor if you make products available in the supply chain without being the manufacturer or the importer (Article 3, point (17)).

What do I have to check as a distributor?

The CE marking, the identification and contact details of the manufacturer and importer, the information and instructions to the user, the end of the support period and the enclosed declaration of conformity (Article 20(2)). The CE marking on its own is not enough.

What do I do if I learn of a vulnerability?

Inform the manufacturer without undue delay. Where there is a significant cybersecurity risk, also inform the market surveillance authorities of the Member States in which you have made the product available (Article 19(5), Article 20(4)). Notification on the ENISA platform remains the manufacturer's job.

Do I become a manufacturer if I put my logo on a product?

Yes. Anyone who places a product on the market under their own name or trademark is considered a manufacturer under Article 21, with all the obligations under Articles 13 and 14.

As a manufacturer, do I have to appoint an authorised representative?

No. Article 18(1) describes an option, not an obligation. For manufacturers without an establishment in the EU, however, it is often the practical way to keep documentation available in the Union.

Is an online marketplace liable under the CRA?

Only if it sells products itself (distributor) or sells own-brand products (manufacturer). Pure intermediation falls outside the CRA under recital 78.

For how long must I be able to name suppliers and customers?

Ten years, under Article 23. This applies to all economic operators, including distributors.

Further reading

Sources

The reporting obligation already applies. Who answers at night at your company?

CRA Response Center monitors your security mailbox, recognises important reports using AI hosted in Germany (your e-mails never go to OpenAI, Anthropic or Google) and alerts your people by SMS and e-mail. EUR 190 per month including VAT. Try it free for 30 days.

Try it free for 30 days