CRA Obligations for Importers and Distributors

The Cyber Resilience Act (Regulation (EU) 2024/2847), or CRA, does not only address manufacturers. It spreads responsibility across the supply chain and places obligations on everyone through whose hands a product with digital elements reaches the EU market. If you import or resell a product, you cannot simply rely on the manufacturer having done everything right. This chain of responsibility is part of the overall framework set by the Cyber Resilience Act.

Importers are economic operators established in the EU that place on the market a product with digital elements bearing the name or trademark of a person established outside the Union. Typically, this is a manufacturer from a non-EU country. Placing on the market means the first making available of a product on the Union market. Distributors are economic operators in the supply chain that make a product with digital elements available on the market without changing its properties. They are neither the manufacturer nor the importer. Manufacturers, importers, and distributors are all economic operators under the CRA, with graded obligations.

Contents

1. Three roles in the supply chain: manufacturer, importer, distributor
2. Obligations of importers
3. Obligations of distributors
4. When importers or distributors become the manufacturer
5. Identification in the supply chain
6. Penalties for infringements

Three roles in the supply chain: manufacturer, importer, distributor

Which obligations apply depends only on the role an economic operator plays in the supply chain. The CRA distinguishes three roles with clearly graded obligations.

Role	When you have this role	Core obligation
Manufacturer	Develops the product or has it developed or manufactured, and places it on the market under its own name or trademark	Bears the full obligations
Importer	Established in the Union; places a product on the Union market for the first time that bears the name or trademark of a person established outside the Union	Actively checks that the manufacturer has met its obligations
Distributor	Makes a product available on the market without changing its properties, without being the manufacturer or importer	Verifies with due care the CE marking and the visible obligations

Obligations of importers

Importers must place on the market only products with digital elements that meet the essential cybersecurity requirements and whose manufacturer has processes that comply with the CRA. The importer is therefore not just a logistics provider but a checkpoint.

Before placing a product on the market, the importer must actively check that the manufacturer has done its part:

• The manufacturer has carried out the appropriate conformity assessment procedure and drawn up the technical documentation.
• The product bears the CE marking. It is accompanied by the EU declaration of conformity and the information and instructions to the user, in a language that is easy to understand.
• The manufacturer has provided its identification and contact details.

Checking for correct CE marking is therefore one of the importer's core tasks. On request, the importer must be able to prove these checks with the necessary documents.

If the importer has doubts about conformity, it must not place the product on the market until conformity has been established. If the product presents a significant cybersecurity risk, the importer must also inform the manufacturer and the market surveillance authorities.

The importer must also be visible. It must state its name, registered trade name or trademark, postal address, and an email address or other digital contact. This information goes on the product, on its packaging, or in an accompanying document. For example, if a European importer places an NB-IoT gateway from a non-EU manufacturer on the market, its contact details must appear on the device or the packaging. This allows authorities and users to reach the responsible economic operator in the Union.

The importer's responsibility continues after the product is placed on the market:

• If it becomes aware of non-conformity, it must immediately take corrective measures and bring the product into conformity, or withdraw or recall it if necessary.
• If it becomes aware of a vulnerability, it must inform the manufacturer without undue delay. If the risk is significant, it must also inform the market surveillance authorities.
• It must keep a copy of the EU declaration of conformity for at least 10 years after placing the product on the market, or for the support period if that is longer. It must also be able to provide the technical documentation on request.
• If the manufacturer ceases operations and can no longer meet its obligations, the importer must inform the market surveillance authorities and, to the extent possible, the users.

Obligations of distributors

When making a product with digital elements available on the market, distributors must act with due care in relation to the requirements of the CRA. Their obligations go less deep than those of importers. The importer actively checks that the conformity assessment and the technical documentation were actually completed. The distributor essentially checks what is visible.

Before making a product available, the distributor mainly verifies that:

• the product bears the CE marking,
• the manufacturer and the importer have met their identification, contact, and information obligations,
• all necessary documents have been provided.

The standard is due care, not a full conformity assessment.

If the distributor has doubts about conformity with the essential cybersecurity requirements, it must not make the product available until conformity has been established. If the risk is significant, it must inform the manufacturer and the market surveillance authorities without undue delay. If the distributor becomes aware of non-conformity, it must make sure that corrective measures are taken. If it becomes aware of a vulnerability, it must inform the manufacturer without undue delay, and also the market surveillance authorities if the risk is significant.

This grading matters in practice. A distributor reselling a connected machine controller does not have to work through the content of the manufacturer's technical documentation. It must, however, notice if the CE marking or the contact details are missing, or if obviously required documents have not been provided.

When importers or distributors become the manufacturer

Roles in the supply chain are not fixed. An importer or distributor is considered a manufacturer and is subject to the full manufacturer obligations in either of two cases:

• It places a product with digital elements on the market under its own name or trademark.
• It carries out a substantial modification of a product already placed on the market.

The consequences are significant. Once treated as a manufacturer, the company no longer carries the graded checking obligations of an importer or distributor. It carries full responsibility for conformity assessment, technical documentation, vulnerability handling, and reporting obligations. The CRA obligations for manufacturers go well beyond the obligations in the supply chain.

A closely related rule covers other persons who are neither the manufacturer, the importer, nor the distributor. If such a person carries out a substantial modification of a product with digital elements and makes it available on the market, it is also considered a manufacturer. This closes a gap: without the rule, later changes could alter a product without anyone being accountable for the modified version.

Identification in the supply chain

Authorities must be able to trace the chain of responsibility. Economic operators must therefore provide information on where they obtained products and whom they supplied. On request, they must give market surveillance authorities the name and address of every economic operator that supplied them with a product with digital elements. Where available, they must also give the name and address of every economic operator they supplied with a product.

This obligation is time-bound. Economic operators must be able to present the information for 10 years after being supplied with the product and for 10 years after supplying it. This keeps the supply chain traceable over a long period, from the manufacturer through the importer to the distributor.

Penalties for infringements

Infringements of importer and distributor obligations are subject to penalties. The importer and distributor obligations belong to the obligations of economic operators. For infringements of these obligations, the CRA provides for administrative fines of up to €10 million. If the offender is a company, the fine can instead reach up to 2% of its total worldwide annual turnover for the preceding financial year, whichever is higher.

The level of possible fines shows that the CRA takes supply chain roles seriously. The page on CRA penalties explains the penalty framework in more detail.

The CRA assigns responsibility clearly along the supply chain, but it leaves some boundary questions open. Examples are when a change counts as substantial and when a distributor in effect becomes an importer. The CRA FAQ answers further common questions about the Cyber Resilience Act. If you want to understand which role your company plays under the CRA and which obligations follow from it, a no-obligation call is a good way to clarify this.