Roles under the CRA: Manufacturer, Importer and Distributor at a Glance

The EU Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) does not spread its duties evenly across everyone involved. Whoever develops, imports or resells a product with digital elements carries a different responsibility. This page provides a technical-organisational orientation on the four economic-operator roles and compares their duties. It offers guidance, not binding individual advice; a legal assessment in the specific case remains reserved for legal counsel.

Manufacturer (Art. 13) - the main product-security burden

The manufacturer carries the actual substantive responsibility. Its duties include:

• Meeting the essential cybersecurity requirements of Annex I Part I on the basis of a documented risk assessment.
• Vulnerability handling under Annex I Part II across the whole support period, with a software bill of materials (SBOM), security updates and a coordinated vulnerability disclosure (CVD) policy.
• Technical documentation under Annex VII.
• Conformity assessment under Art. 32: self-assessment (Module A) for products not listed in Annex III or IV; third-party assessment for Class II and critical products, and for Class I where harmonised standards, common specifications or a European scheme are not applied in full.
• EU Declaration of Conformity (Art. 28, Annex V) and affixing the CE marking (Art. 30).
• Reporting obligations under Art. 14 (actively exploited vulnerabilities and severe incidents having an impact on the security of the product) via the single reporting platform (Art. 16).
• In case of non-conformity: corrective action, withdrawal or recall.

Two figures shape the manufacturer's effort: the support period is at least five years (shorter only where the expected time of use is shorter), and technical documentation together with the EU Declaration of Conformity must be retained for at least ten years (or the support period, whichever is longer). Full details in our article on the manufacturer duties under the CRA.

Importer (Art. 19) - the gatekeeper at market entry

The importer places a non-EU manufacturer's products on the Union market. Its task is to verify conformity before placing the product on the market. Its core duties:

• Place only conforming products on the market, and specifically verify that the conformity assessment has been carried out, the technical documentation drawn up and the CE marking affixed.
• Do not place non-conforming products on the market.
• Indicate its own contact details on the product, its packaging or in the accompanying documents.
• In case of non-conformity: take corrective action.
• Inform the manufacturer of vulnerabilities and, where there is a significant cybersecurity risk, the market surveillance authorities.

On the distinction: the importer does not carry out the conformity assessment itself, does not draw up the technical documentation and does not affix the CE marking - these remain manufacturer duties. More on this on our page covering the importer duties.

Distributor (Art. 20) - due care in the supply chain

The distributor makes a product available on the market without being the manufacturer or importer. It acts with due care in relation to the requirements of the CRA (Art. 20(1)):

• Verify that the CE marking is present and that the manufacturer or importer has met their marking and information duties.
• Do not make non-conforming products available on the market.
• In case of non-conformity: make sure that corrective action is taken.
• Inform the manufacturer of vulnerabilities and, where there is a significant cybersecurity risk, the market surveillance authorities.

The distributor's verification depth is lower than the importer's - it is a plausibility and due-care check, not a re-assessment of conformity. Details in our article on the distributor duties.

Authorised representative (Art. 18) - tasks under a written mandate

A manufacturer may appoint an authorised representative in writing; in practice this matters mainly for manufacturers outside the EU. The mandate must at least allow the representative to keep the EU Declaration of Conformity and the technical documentation at the disposal of the market surveillance authorities, to provide them with the evidence on reasoned request and to cooperate with them (Art. 18(3)). Important: certain manufacturer duties cannot form part of the mandate (Art. 18(2)): design to Annex I, the risk assessment, vulnerability handling, drawing up the technical documentation and conformity in series production remain with the manufacturer.

Duty-allocation matrix: who bears what?

The following overview shows which role is responsible for which duty. The authorised representative (Art. 18) is deliberately not given its own column, as it performs only the tasks set out in its mandate (at least keeping the EU Declaration of Conformity and documentation available, providing information and cooperating with the authorities) and cannot take over the manufacturer duties listed in Art. 18(2).

✅ = duty of that role · - = no original duty of that role under the CRA

The practical starting point

Before allocating duties, clarify two questions: which role do I actually take on per product? and is the product in scope of the CRA at all? One and the same company can simultaneously be a manufacturer, importer and distributor for different products - duties are determined per product and role, not blanket per company. In practice this means: build a product-role register recording, for each product, the role in which you place it on the market and which of the duties shown above follow from that. This register also becomes the basis for demonstrating compliance to the market surveillance authorities. Our applicability check gives a first orientation per product.