I'm not in the EU — does the Cyber Resilience Act still apply to me?
Yes. The Regulation is market legislation: it attaches to products made available on the EU market, and "made available" means supplied for distribution or use on that market in the course of a commercial activity — the manufacturer's own location is irrelevant [1].
A US, UK, Indian or Australian company selling to EU customers, or distributing through an app store that serves the EU, is a manufacturer in exactly the sense the Regulation means: the person who develops the product, or has it developed, and markets it under their name [2] [1]. Commercial activity is read broadly — charging is sufficient but not necessary, and monetisation through advertising or a connected paid product counts [3].
What being outside the EU changes
One structural thing. A manufacturer may appoint an authorised representative in the Union by written mandate; the representative keeps the declaration of conformity and technical documentation at the disposal of the authorities and cooperates with them [4]. For manufacturers established outside the Union, the representative is how the paperwork has an address inside it — check the current appointment duties for your situation as part of your conformity work rather than assuming the mandate is optional [4].
The representative is an administrative anchor, not an outsourcing of responsibility: the declaration is still yours, the duties are still yours, and the representative's role is defined by the written mandate [4].
The importer route
If you do not sell into the EU directly but a company there imports and resells your product, that importer has duties of its own: importers place only conforming products on the market, and they verify the conformity assessment, the technical documentation, the CE marking and the manufacturer identification before doing so [5]. Practically, this means your EU importers and resellers will be asking you for the documentation stack — the Regulation deputises them as your first auditors [5].
What you cannot route around
Geography changes none of the clocks. The Article 14 reporting duty applies from 11 September 2026 to manufacturers wherever established, for products on the EU market [6]. The full obligations — documentation, declaration, marking — apply from 11 December 2027 on the same basis [7].
The only clean exit is a real one: genuinely not making the product available in the EU, which is a geographic restriction actually enforced, not a missing translation or an unticked storefront box [1].
Check where you stand
The checker asks where and how your product reaches the EU market and tells you your role, your duties and your dates, with citations.
What to do next
Run your own product through the checker — it takes under a minute and gives you a dated, citable result you can send to a customer.
Sources
- Made available on the market means supply for distribution or use on the EU market in the course of a commercial activity. Art. 3(22) — EUR-Lex ↩
- Manufacturer: a natural or legal person who develops or manufactures products with digital elements or has them designed, developed or manufactured, and markets them under their name or trademark, whether for payment, monetisation or free of charge. Art. 3(13) — EUR-Lex ↩
- The Regulation applies to products made available on the market in the course of a commercial activity; charging a price, charging for support, monetising via advertising or data, or otherwise intending to monetise are commercial activity. Art. 2(1), Art. 3(22), Recitals — EUR-Lex ↩
- A manufacturer may appoint an authorised representative by written mandate; the representative keeps the declaration of conformity and technical documentation at the disposal of authorities and cooperates with them. Non-EU manufacturers: reporting is routed via the representative's Member State. Art. 18, Art. 3(15), Art. 14(7) — EUR-Lex ↩
- Importers place only compliant products on the market; verify conformity assessment, technical documentation, CE marking and manufacturer identification; indicate their own name and address; report known vulnerabilities to the manufacturer; keep the declaration of conformity; cooperate with authorities. Art. 19 — EUR-Lex ↩
- Article 14 (reporting obligations of manufacturers) applies from 11 September 2026. Art. 71(2) — EUR-Lex ↩
- The Regulation applies in full from 11 December 2027. Art. 71(2) — EUR-Lex ↩
Related
- What are importer and distributor obligations under the CRA?
Importers verify conformity before placing a product on the EU market and add their own identification; distributors check the paperwork exists and act with due care. Rebranding a product under your own name makes you its manufacturer.
- What are the fines and penalties under the Cyber Resilience Act?
Fines reach EUR 15 million or 2.5% of worldwide annual turnover for breaching the essential requirements or the core manufacturer obligations, and market surveillance authorities can order withdrawal or recall.
- What goes in a CRA declaration of conformity?
A one-document statement, in the Annex V structure, in which the manufacturer takes sole responsibility that the product meets the essential requirements. A simplified web-linked form exists, and it travels with the product's paperwork for a decade or more.
- Does the CRA apply to products placed on the market before December 2027?
Partly. Products placed on the market before full application need conformity only if substantially modified after it — but the Article 14 reporting duty applies to them regardless, and ordinary software updates can cross the modification line.
CEMarque encodes Regulation (EU) 2024/2847 and the European Commission's published guidance as of 10 September 2026 (Facts v2026.09.4). It is not legal advice. Verify obligations for your product with qualified counsel where the stakes require it.