Cyber Resilience Act Response Center Request a demoDemo

Guide Last updated 14 min read

Who is the manufacturer under the CRA? Agency, client, own brand, importer

Most obligations under the Cyber Resilience Act attach to one role: that of the manufacturer. The person who carries it is not always the one who wrote the code. This page explains the concept of the manufacturer, the change of role through own branding and substantial modification, and the typical borderline cases.

Under the Cyber Resilience Act, the manufacturer is whoever develops or manufactures a product with digital elements, or has it developed or manufactured, and markets it under its own name or trademark (Article 3, point (13)). What matters, then, is not who writes the code but whose name the product carries when it reaches the market. An agency that develops to a client's specification is a service provider; the client is the manufacturer if it markets the software. Importers and distributors become manufacturers themselves as soon as they place a product on the market under their own brand or substantially modify it (Article 21). The manufacturer bears the obligations under Article 13 and the reporting obligation under Article 14.

Key points

  • The manufacturer is whoever markets a product under its own name or trademark, even if someone else developed it (Article 3, point (13)).
  • Own branding or a substantial modification turns an importer or distributor into a manufacturer with all the obligations that go with it (Article 21). Other third parties are covered by Article 22.
  • Only software that a company develops itself for its own operations and does not pass on is not placed on the market. Where custom software is supplied to a customer for payment, the BSI and the European Commission treat this as placing on the market, even if the customer only uses it internally; it is then covered by the CRA regardless of the number of units (BSI FAQ on the CRA, Commission services' FAQ, question 4.2.5, Commission guidance, example 7).
  • The authorised representative under Article 18 is not a manufacturer; the core obligations stay with the manufacturer.
  • Since 11 September 2026, the reporting obligation under Article 14 has applied to the manufacturer; importers and distributors pass vulnerabilities on to it.

How does the Regulation define the manufacturer?

The definition in Article 3, point (13) has two halves: the activity (designing, developing or manufacturing a product, or having that done) and the market presence (marketing it under its own name or trademark). Together they make the manufacturer.

The phrase "has products with digital elements designed, developed or manufactured" is the key to many borderline cases. If you buy in the development and sell the result under your own name, you are the manufacturer. If you develop but let someone else market the product under their name, you are not. The manufacturer bears the obligations under Article 13 and the reporting obligation under Article 14; the guide Manufacturer obligations under Article 13 CRA gives an overview. The precondition is always that the product is made available on the EU market in the course of a commercial activity (Article 3, point (22)). The Applicability Check helps you establish whether that is the case.

Agency or client: who is the manufacturer of custom software?

Article 3, point (13) sets the direction: whoever has a product developed and markets it under its own name is the manufacturer. The Commission guidance C(2026) 5252 of 27 July 2026 contains no specific rule for commissioned development; it uses the concept of "primary control" over development, releases and distribution only for open-source software (paragraph 49). Article 3, point (13) therefore remains decisive: where an agency develops to the client's specification, the client is the manufacturer if it markets the software under its own name; the agency is a service provider. The guidance is not legally binding.

Three cases can be distinguished:

  • The client uses the software only internally. An agency builds a planning tool for a customer that uses it exclusively for itself. Internal use alone does not take the software outside the CRA: according to the BSI and the Commission, supply for payment is making available on the market. In its FAQ on the CRA, the BSI expressly mentions custom software regardless of the number of units, the Commission services' FAQ treats software for a specific business user as a tailor-made product (question 4.2.5), and the guidance treats a licence for an internal platform as placing on the market (paragraph 11, example 7). The manufacturer is usually the agency, because the customer markets nothing under its own name. The position is different only where the customer develops the software itself and passes nothing on (Commission services' FAQ, question 1.5). It is not settled who the manufacturer is when the software runs under the customer's name or is created under the customer's instructions and control.
  • The client markets the software. A machine builder has an operating app developed and ships it with its machines. It is the manufacturer of the app; the agency is a service provider.
  • The agency markets the product itself. If the agency sells its own product under its own name, such as a shop system or a plugin, it is the manufacturer. In the BSI's reading (FAQ on the CRA), this applies regardless of the number of units and of general availability: custom software supplied commercially to a single customer is also a product.

A contract can allocate tasks, but it does not change who markets the product under its own name or trademark. Agency and client should therefore agree in advance who approves releases, who handles vulnerabilities and who reports. More on this in the guide The CRA for agencies and custom software.

Own brand and white label: when does a distributor become a manufacturer?

Under Article 21, an importer or distributor is considered a manufacturer, with the obligations under Articles 13 and 14, in two cases. First, where it places a product on the market under its own name or trademark. Second, where it carries out a substantial modification of a product already placed on the market. This is the classic white-label case: an IT systems integrator buys in a firewall, puts its own logo on it and sells it as its own product. It is then the manufacturer of an important product, class II, subject to assessment by a notified body or under a certification scheme (Article 32(3)). It makes no difference that it has never seen the code.

A business that only resells, without changing the name, remains a distributor with the verification duties under Article 20, and passes on any vulnerability it learns of to the manufacturer without undue delay (Article 20(4)). A business that brings products into the EU from a third country is an importer under Article 19. The guide Importers, distributors and authorised representatives describes both roles.

Substantial modification by third parties: Article 22

Article 21 concerns importers and distributors. Everyone else is covered by Article 22(1): any person who carries out a substantial modification of a product already placed on the market and then makes it available is considered a manufacturer, for example a systems integrator that adapts firmware. Article 22(2) limits the consequence: the obligations under Articles 13 and 14 apply to the modified part or, where the modification affects the cybersecurity of the product as a whole, to the entire product. Under Article 3, point (30), a modification is substantial if it affects compliance with Annex I, Part I or changes the intended purpose. A security update is not a substantial modification; a new remote connection usually is. Examples are in the guide Substantial modification.

Groups, authorised representatives, open-source stewards: the special cases

A subsidiary imports from its parent in a third country

The CRA has no group privilege. If an EU subsidiary places on the market products that its parent manufactures outside the EU under the parent's name, the subsidiary is an importer (Article 3, point (16), obligations under Article 19). If it sells them under its own brand, it becomes the manufacturer under Article 21. One possible arrangement: the parent remains the manufacturer, and the subsidiary is the importer and, with a written mandate, also the authorised representative under Article 18. The Commission's Blue Guide expressly allows for this dual role; the subsidiary then carries both sets of obligations (sections 3.2 and 3.3). It keeps the declaration of conformity and the technical documentation at the disposal of market surveillance authorities (Article 18(3)), while the manufacturer's obligations under Article 13(1) to (11) stay with the parent (Article 18(2)).

The authorised representative is not a manufacturer

Under Article 18(1), a manufacturer may appoint an authorised representative in the EU by written mandate; this is an option, not a requirement. The authorised representative keeps the declaration of conformity and the technical documentation at the disposal of market surveillance authorities, provides evidence and cooperates on action to eliminate risks (Article 18(3)). The core obligations remain with the manufacturer: Article 18(2) rules out delegating Article 13(1) to (11), the technical documentation and conformity of production. The authorised representative should not be confused with the Assigned Representative, the role that submits notifications on the ENISA platform.

Open-source steward

Under Article 3, point (14), an open-source software steward is a legal person, other than a manufacturer, that provides sustained support for the development of free and open-source software intended for commercial activities, typically a foundation or an association. Article 24 sets out a lighter regime: a cybersecurity policy, cooperation with market surveillance authorities, and from 11 December 2027 the reporting of actively exploited vulnerabilities and, within limits, of severe incidents (Article 24(3)); no CE marking and no administrative fines (Article 64(10)). Anyone who sells open-source software is a manufacturer like any other. Details are in the guide Open source and the CRA.

Decision tree: which role do I have?

  1. Is the product made available on the EU market in the course of a commercial activity?No: the CRA does not apply (Article 3, point (22)), for example to internal tools you developed yourself or to open-source software without monetisation. Yes: continue.
  2. Does the product carry your name or trademark?Yes: you are the manufacturer (Article 3, point (13)), even if someone else developed it. No: continue.
  3. Have you substantially modified the product and are you making it available?Yes: you are considered a manufacturer, under Article 21 if you are an importer or distributor, otherwise under Article 22. There, paragraph 2 limits the obligations to the modified part or, where the cybersecurity of the product as a whole is affected, to the entire product. No: continue.
  4. Do you bring the product into the EU from a third country?Yes: importer (Article 3, point (16), obligations under Article 19). No: continue.
  5. Do you resell other companies' products?Yes: distributor (Article 3, point (17), obligations under Article 20). No: continue.
  6. Are you a legal person supporting an open-source project without selling it yourself?Yes: possibly an open-source software steward (Article 3, point (14), obligations under Article 24). No: a service provider without a role of your own, for example as an agency, or a user.

Examples

All examples are fictitious; in each individual case, what decides is who markets the product under its own name or trademark (Article 3, point (13)).

CaseRoleReason
A manufacturer of packaging machines buys in a controller, builds it in and sells the machine under its own name.Manufacturer of the machineThe machine with its controller is its product (Article 3, point (13)). For the bought-in controller, the due diligence obligation under Article 13(5) applies; the supplier remains the manufacturer of the controller.
A specialist network equipment retailer resells routers from an EU manufacturer unchanged.DistributorNo own name, no modification (Article 3, point (17), obligations under Article 20).
The same retailer has the routers made with its own logo and its own model designation.ManufacturerPlacing on the market under its own brand (Article 21). Routers are important products, class I.
An agency develops an app that a device manufacturer ships with its devices under its own name.The device manufacturer is the manufacturer, the agency a service providerThe device manufacturer has the app developed and markets it under its own name (Article 3, point (13)).
A software company offers its application exclusively in the browser, with no installation at the customer's end.Not a manufacturer under the CRAPure SaaS applications are not products with digital elements (recital 12); depending on its size, NIS2 applies. An app, or a backend without which a product function fails, would by contrast be covered; see SaaS, cloud and remote data processing.

What this means in practice

The role determines the reporting obligation. Since 11 September 2026, the manufacturer has had to notify actively exploited vulnerabilities to the ENISA platform within 24 hours of becoming aware of them. Importers and distributors do not report themselves; they inform the manufacturer without undue delay (Article 19(5), Article 20(4)). A business that considers itself a distributor but sells a product under its own brand has the reporting obligation without knowing it. A client that has software developed and markets it bears the obligation, even if the agency maintains the code.

Management should therefore establish for which products the company is the manufacturer, including own brands and commissioned developments it markets, and who internally assesses awareness and starts the clock. For the second point, CRA Response Center provides the readiness: it recognises important messages in the security mailbox, alerts the people responsible and records awareness and deadlines in the history. Clarifying the role is up to the manufacturer, with legal advice if in doubt.

Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit

Frequently asked questions

Am I the manufacturer if I did not write the software myself?

Yes, if you have it developed and market it under your own name or trademark (Article 3, point (13)). The developer is then your service provider or supplier.

Do I become the manufacturer if I just put my logo on someone else's product?

Yes. Article 21 makes importers and distributors manufacturers as soon as they place a product on the market under their own name or trademark. All the obligations under Articles 13 and 14 pass to you.

Who is the manufacturer when an agency develops for a client?

Under Article 3, point (13), whoever has the software developed and markets it under its own name or trademark. As a rule that is the client; the agency is a service provider. The Commission guidance contains no specific rule on this.

Does the CRA apply to custom software used by only one customer?

If the customer develops the software itself for its own operations and does not pass it on, there is no supply to anyone else and therefore no placing on the market. If a provider supplies custom software for payment, the CRA applies in the BSI's reading regardless of the number of units and of general availability; the Commission services' FAQ (question 4.2.5) and the Commission guidance (paragraph 11, example 7) take the same view. The guidance and the FAQ are not binding; only the Court of Justice of the European Union can give a binding interpretation. What remains open is mainly who the manufacturer is in borderline cases, for instance when the software runs under the customer's name.

Does an importer or distributor have to report to ENISA itself?

No. The reporting obligation under Article 14 applies to the manufacturer. Importers and distributors inform the manufacturer without undue delay and, where there is a significant risk, also the market surveillance authorities (Article 19(5), Article 20(4)).

Further reading

Sources

The reporting obligation already applies. Who answers at night at your company?

CRA Response Center monitors your security mailbox, recognises important reports using AI hosted in Germany (your e-mails never go to OpenAI, Anthropic or Google) and alerts your people by SMS and e-mail. EUR 190 per month including VAT. Try it free for 30 days.

Try it free for 30 days