What do importers and distributors have to do under the Cyber Resilience Act?
The Regulation assigns duties to three roles in the supply chain, and which one you occupy is a question of fact, not of what your contract calls you.
Importers
An importer places a product from outside the Union on the EU market. Importers place only conforming products on the market: before doing so they verify that the manufacturer carried out the conformity assessment, drew up the technical documentation, affixed the CE marking and can be identified — and the importer indicates its own name and address on or with the product [1]. Importers also report vulnerabilities they become aware of to the manufacturer, and cooperate with the authorities [1].
The verification duty makes importers the enforcement layer closest to non-EU manufacturers: an importer who cannot obtain the documentation stack from its supplier cannot lawfully place the product on the market [1].
Distributors
A distributor makes a product available further down the chain without importing it. Distributors act with due care: they verify that the CE marking is present, that the declaration of conformity exists, and that the manufacturer and any importer met their identification duties; they do not make a product available when they have reason to believe it does not conform; and they report vulnerabilities they learn of to the manufacturer and cooperate with authorities [2].
Due care is a lighter standard than the importer's verification — a distributor checks that the paperwork exists rather than re-performing the assessment — but it is not passive: knowingly moving a product without its marking or declaration is the distributor's own breach [2].
The rebranding trap
The role boundaries have one sharp edge. Marketing a product under your own name or trademark makes you its manufacturer, even if someone else developed it entirely [3]. White-labelling, OEM arrangements and "powered by" products that hide the upstream vendor all cross this line: the manufacturer is the person who markets the product under their name, and the manufacturer's full obligations follow [3] [4].
So a reseller has a real choice to make. Sell the product under the maker's brand and carry distributor duties; put your own brand on it and carry the manufacturer's [3] [2].
Why this matters commercially
Importer and distributor obligations sit in the fine bands too — the middle band reaches EUR 10,000,000 or 2% of worldwide turnover [5]. From full application on 11 December 2027, EU resellers will demand the documentation stack before listing a product, because their own liability depends on its existence [6] [1] [2]. Manufacturers who have the stack ready will find EU distribution easier to win; the checklist your channel partners run is written in these two Articles [1] [2].
Check where you stand
The checker asks how the product reaches the EU market and under whose name, tells you which role you occupy, and lists that role's duties with citations.
What to do next
Run your own product through the checker — it takes under a minute and gives you a dated, citable result you can send to a customer.
Sources
- Importers place only compliant products on the market; verify conformity assessment, technical documentation, CE marking and manufacturer identification; indicate their own name and address; report known vulnerabilities to the manufacturer; keep the declaration of conformity; cooperate with authorities. Art. 19 — EUR-Lex ↩
- Distributors act with due care; verify CE marking, declaration of conformity and manufacturer/importer obligations; do not make non-compliant products available; report vulnerabilities to the manufacturer; cooperate with authorities. Art. 20 — EUR-Lex ↩
- Marketing a product under your own name or trademark makes you the manufacturer even if someone else developed it. Art. 3(13), Art. 21 — EUR-Lex ↩
- Manufacturer: a natural or legal person who develops or manufactures products with digital elements or has them designed, developed or manufactured, and markets them under their name or trademark, whether for payment, monetisation or free of charge. Art. 3(13) — EUR-Lex ↩
- Fines up to EUR 15,000,000 or 2.5% of total worldwide annual turnover, whichever is higher (essential requirements in Annex I; obligations in Arts. 13 and 14); up to EUR 10,000,000 or 2% (other listed obligations, incl. Arts. 18–23, 28, 30, 31, 32); up to EUR 5,000,000 or 1% (incorrect, incomplete or misleading information to notified bodies or authorities). Microenterprises and small enterprises are not fined for missing the 24-hour early-warning deadline; open-source software stewards are not subject to fines. Art. 64(2)–(4), (10) — EUR-Lex ↩
- The Regulation applies in full from 11 December 2027. Art. 71(2) — EUR-Lex ↩
Related
- Does the CRA apply to non-EU manufacturers?
Yes. The Regulation follows the product, not the company: making a product available on the EU market commercially puts you in scope wherever you are, with an authorised representative anchoring the paperwork inside the Union.
- What are the fines and penalties under the Cyber Resilience Act?
Fines reach EUR 15 million or 2.5% of worldwide annual turnover for breaching the essential requirements or the core manufacturer obligations, and market surveillance authorities can order withdrawal or recall.
- What goes in a CRA declaration of conformity?
A one-document statement, in the Annex V structure, in which the manufacturer takes sole responsibility that the product meets the essential requirements. A simplified web-linked form exists, and it travels with the product's paperwork for a decade or more.
- Is my product an important product class II under the CRA?
Class II is the higher "important" tier — hypervisors, firewalls, tamper-resistant microprocessors and similar security-critical categories — and it removes self-assessment entirely: a notified body or certification scheme is mandatory.
CEMarque encodes Regulation (EU) 2024/2847 and the European Commission's published guidance as of 10 September 2026 (Facts v2026.09.4). It is not legal advice. Verify obligations for your product with qualified counsel where the stakes require it.