Cyber Resilience Act for Importers and Distributors: Articles 19 to 23

Are you an importer or a distributor?

Placing on the market means the first making available on the EU market; making available means any supply in the course of a commercial activity, paid or free. So for each product there is one importer, the first in the EU, while every later reseller is a distributor.

When the duties apply

Under Article 69(2), products placed on the market before 11 December 2027 fall under the Regulation only if they are substantially modified from that date, except for the Article 14 reporting duties, which apply to them too.

Importers: what to check before you sell

Under Article 19(1), importers may place on the market only products that meet the essential requirements in Part I of Annex I, from a manufacturer whose vulnerability handling processes meet Part II. Before placing a product on the market, you must ensure that (Article 19(2)):

• the manufacturer has carried out the right conformity assessment procedure (Article 32);
• the manufacturer has drawn up the technical documentation;
• the product bears the CE marking and comes with the EU declaration of conformity and the user information and instructions in Annex II, in a language users and authorities can easily understand;
• the manufacturer has met Article 13(15), (16) and (19): a type, batch or serial number, the manufacturer's name and contact details, and the end date of the support period, at least month and year, shown at the time of purchase.

You must be able to show documents proving these checks. Add your own name, trade name or trademark, postal address and email or other digital contact on the product, its packaging or an accompanying document (Article 19(4)).

Distributors: what to verify

Distributors must act with due care (Article 20(1)). Before making a product available, verify that (Article 20(2)):

• it bears the CE marking;
• the manufacturer and importer have met Article 13(15), (16), (18), (19) and (20) and Article 19(4): identification number, contact details of manufacturer and importer, the Annex II user information, the support period end date, and the EU declaration of conformity or a simplified version with a link to the full one;
• you have received all necessary documents.

A practical test: if a supplier cannot tell you the support period end date or give you the declaration of conformity, that is a red flag under both Article 19 and Article 20. Build these items into your supplier onboarding. Our vendor risk guide covers the wider process.

When something is wrong

Importers must also tell the authorities if they have reason to believe a product may present a significant cybersecurity risk because of non-technical risk factors (Article 19(3)). Both roles must give the authorities, on a reasoned request, the information needed to show conformity, and cooperate on measures to remove risks (Articles 19(7) and 20(5)).

Reporting actively exploited vulnerabilities and severe incidents to CSIRTs and ENISA under Article 14 is the manufacturer's duty; see our CRA reporting guide. It becomes yours if you are treated as the manufacturer.

Records you must keep

• Importers: a copy of the EU declaration of conformity, and the ability to make the technical documentation available to authorities, for at least 10 years after placing on the market or for the support period, whichever is longer (Article 19(6)).
• All economic operators: who supplied you, and where available, whom you supplied, for 10 years after each supply (Article 23).

When you become the manufacturer

Under Article 21, an importer or distributor is treated as the manufacturer, with all the duties in Articles 13 and 14, if it:

• places a product on the market under its own name or trademark, for example white-label devices or rebranded software; or
• carries out a substantial modification of a product already on the market: a change that affects compliance with the Part I essential requirements or changes the intended purpose the product was assessed for.

Article 22 applies the same logic to anyone else who substantially modifies a product and makes it available, limited to the affected part unless the change affects the product's cybersecurity as a whole. The manufacturer's duties are set out in our Annex I checklist.

Penalties

Breaches of Articles 18 to 23 can lead to fines of up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher (Article 64(3)). If you are treated as the manufacturer, breaches of Annex I or Articles 13 and 14 reach EUR 15 million or 2.5% (Article 64(2)). Giving incorrect, incomplete or misleading information to authorities can cost up to EUR 5 million or 1% (Article 64(4)). Authorities must consider the size of the business, in particular for SMEs (Article 64(5)).

Getting ready before December 2027

1. List the products with digital elements you import or resell, and your role for each.
2. Ask each manufacturer for its CRA plan: conformity assessment route, support period, declaration of conformity, and a contact for vulnerabilities.
3. Add the Article 19(2) or 20(2) checks to your purchasing and onboarding process, and keep the evidence.
4. Set up a route for passing vulnerability reports to manufacturers and, where needed, the authorities.
5. Check white-label and customised products: those make you the manufacturer.

Turn the checks into supplier onboarding. The Vendor Security Assessment Pack includes a vendor security questionnaire, a security requirements addendum, an onboarding checklist, a risk register, a data processing agreement template and an exit plan template.

Sources

• Regulation (EU) 2024/2847 (Cyber Resilience Act), Articles 3, 13, 14, 19 to 23, 64, 69 and 71, EUR-Lex

Related tools