Manufacturer Duties under the CRA: What Art. 13 Really Requires

Under the EU Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) the manufacturer is the role with the actual substantive responsibility. Importers and distributors are gatekeepers who verify; the manufacturer is the one who actually creates, documents and demonstrates product security. Anyone who develops a product with digital elements, or has it developed, and markets it under their own name or trademark carries the full breadth of duties under Art. 13. An importer or distributor becomes a manufacturer if it places a product on the market under its own name or trademark or substantially modifies a product already placed on the market (Art. 21); other persons who substantially modify a product and make it available bear the manufacturer duties for the modified part, or for the entire product if the modification affects its cybersecurity as a whole (Art. 22). This page orders the duties technically and organisationally, along the text of the Regulation and the article and annex numbers cited. It is general orientation, not legal advice within the meaning of the German Legal Services Act (RDG); the binding assessment of the individual case remains reserved for legal counsel.

1. Meet the essential requirements (Annex I Part I)

The starting point of every manufacturer duty is a cybersecurity risk assessment. The product must be designed, developed and produced so that it ensures an appropriate level of cybersecurity based on the risks (Annex I Part I(1)), with a secure-by-default configuration (point 2(b)). Annex I Part I(2) lists a set of protection objectives that apply according to risk: making available without known exploitable vulnerabilities, a secure default configuration with reset capability, protection against unauthorised access (e.g. through authentication), protection of the confidentiality and integrity of data (encryption where appropriate), data minimisation, availability of essential functions (mitigation of denial-of-service attacks), minimisation of the attack surface, limitation of the impact of an incident, recording of security-relevant activity, and the ability to remediate vulnerabilities through security updates. Important: these requirements are risk-based - not every one applies equally to every product. The risk assessment shows which ones apply, and it becomes part of the technical documentation.

2. Vulnerability handling (Annex I Part II) - including SBOM and CVD

Unlike the one-off certification of some frameworks, vulnerability handling is a continuing duty across the whole support period. Annex I Part II requires the manufacturer, among other things, to:

• Identify and document vulnerabilities and components - including a software bill of materials (SBOM) in a commonly used, machine-readable format covering at least the top-level dependencies.
• Address and remediate vulnerabilities without delay, in particular through security updates - provided separately from functionality updates where technically feasible.
• Regularly test and review the security of the product.
• Publish information about fixed vulnerabilities once a security update has been made available; in duly justified cases publication may be deferred until users have had the opportunity to apply the patch.
• Put in place and enforce a coordinated vulnerability disclosure (CVD) policy, together with a contact address for reporting.
• Distribute security updates securely and provide them without delay and free of charge (a different arrangement is possible for tailor-made products for business users).

3. Draw up the technical documentation (Annex VII)

The technical documentation is the written evidence that the essential requirements are met. Under Annex VII it contains, among other things: a general product description; the design, development and production processes as well as the vulnerability-handling processes (architecture, SBOM, CVD policy, update distribution); the cybersecurity risk assessment with reference to the requirements of Annex I; the information taken into account when determining the support period; the standards, specifications and certification schemes applied; test reports; and a copy of the EU Declaration of Conformity. It must be kept up to date. A deeper structure and content overview is in our article on CRA technical documentation.

4. Carry out the conformity assessment (Art. 32) - the class-dependent route

How conformity is demonstrated depends on the product class. The CRA knows four tiers; the assessment route differs markedly:

Rule of thumb: Third-party assessment is required in every case for Class II and critical products, and for Class I whenever harmonised standards, common specifications or a European scheme (assurance level at least ‘substantial’) are not applied in full. Products not listed in Annex III or IV can self-assess. “All products need a notified body” is a misconception. Which class your product falls into is covered on our page on CRA product classes.

5. Issue the EU Declaration of Conformity (Art. 28) and affix CE (Art. 30)

Once the conformity assessment has demonstrated that the requirements are met, the manufacturer issues the EU Declaration of Conformity (Art. 28, content under Annex V) and thereby assumes responsibility for compliance. It identifies the product and the manufacturer, declares conformity, names the standards/specifications/schemes applied and - where relevant - the notified body (name, number, procedure, certificate), and is signed. The manufacturer then affixes the CE marking (Art. 30). The CE marking is the visible declaration that the product complies with the relevant Union legislation - here the CRA. Under the CRA it is required for products placed on the market from general application on 11 December 2027.

6. Reporting obligations (Art. 14) - since 11 September 2026

Since 11 September 2026, the manufacturer has been required to report actively exploited vulnerabilities and severe incidents having an impact on the security of the product simultaneously to the CSIRT designated as coordinator and to ENISA via the single reporting platform (Art. 16). Reporting has several stages, and the final-report deadlines differ:

Note: the final-report deadline differs: 14 days (vulnerability) versus one month (incident). Not “14 days for both”.

The reporting obligations also apply to products already on the market. In addition, the manufacturer informs the affected users of the vulnerability or incident and of possible mitigating measures (Art. 14(8)). For micro and small enterprises, Article 64(10) provides an exception with regard to missing the 24-hour early warning; its scope is a question of interpretation, because paragraph 10 derogates only from paragraphs 3 to 9 while infringements of Article 14 fall under paragraph 2 (recital 120 assumes no fines are imposed).

7. Support period and retention

Two periods must be kept apart:

• Support period ≥ 5 years: The manufacturer sets the support period so that it reflects the expected time of use of the product, and provides vulnerability handling and security updates during that time. It is at least five years; it is shorter only where the expected time of use is shorter (Art. 13(8)).
• Retention ≥ 10 years: Technical documentation and the EU Declaration of Conformity must be retained for at least ten years after placing on the market - or for the support period, whichever is longer (Art. 13(13)).

8. Corrective action, withdrawal, recall

Where the manufacturer knows or has reason to believe that a product or its processes do not (or no longer) meet the essential requirements, it must, from placing on the market and during the support period, take corrective action immediately - bring the product into conformity, withdraw it from the market or recall it (Art. 13(21)). On a reasoned request, it provides the market surveillance authority with the evidence and cooperates with it (Art. 13(22)). For actively exploited vulnerabilities and severe incidents it also informs the affected users (Art. 14(8)). This keeps conformity in place across the whole lifecycle rather than ending at the point of placing on the market.

Manufacturer duties checklist

1. Clarify applicability: Is the product a product with digital elements in CRA scope? Which product class does it fall into?
2. Carry out a cybersecurity risk assessment and map it to Annex I.
3. Design and develop the product according to Annex I Part I, with a secure default configuration.
4. Build a vulnerability-handling process under Annex I Part II: SBOM, CVD policy with contact address, secure and free update distribution.
5. Draw up the technical documentation under Annex VII and keep it current.
6. Carry out the conformity assessment under Art. 32 appropriate to the class (self-assessment or notified body).
7. Issue the EU Declaration of Conformity (Art. 28) and affix the CE marking (Art. 30).
8. Set up the Art. 14 reporting process (early warning without undue delay and at the latest within 24 hours; notification within 72 hours; final report 14 days after a corrective or mitigating measure is available, or one month after the notification), mandatory since 11 September 2026.
9. Define and indicate the support period (≥ 5 years); ensure retention (≥ 10 years).
10. Establish a process for corrective action, withdrawal and recall.

Roadmap to 11 December 2027

General application begins on 11 December 2027. The substantive tasks (risk assessment, vulnerability process, documentation) need lead time, and the reporting obligations have already applied since 11 September 2026.

• Immediately: Have the Art. 14 reporting process operational (mandatory since 11 Sep 2026); complete the product-role register and classification.
• By early 2027: Carry out the risk assessment per product; build vulnerability handling including SBOM and CVD policy.
• Now to 2027: Implement the essential requirements; write the technical documentation under Annex VII; choose the appropriate conformity route and approach a notified body early for Class II, critical products and Class I without fully applied harmonised standards.
• By 11 Dec 2027: Complete the conformity assessment, issue the EU Declaration of Conformity, affix the CE marking.

The comparison of CRA roles shows where you carry the manufacturer burden across your portfolio and where only the gatekeeper role. Our applicability check gives a first orientation per product.