Independent information resource Product security · EU CRA
CRA economic operators / 06

Can a Software Developer Be a CRA Manufacturer?

Understand when a software developer is the manufacturer under the Cyber Resilience Act, including employees, contractors, software publishers, outsourced development, branding and product responsibility.

IN BRIEF

CRA manufacturer status follows the relationship between development, product responsibility and market identity. A developer that creates and markets its own software product can be the manufacturer. An employee or contractor developing software for another company's branded product is not automatically the manufacturer merely because it wrote the code.

01 / 09

A Developer Can Be the Manufacturer

Article 3 defines a manufacturer broadly enough to include a person that develops or manufactures a product with digital elements and markets it under its own name or trademark. A software developer that creates, controls and markets its own software product can therefore be the CRA manufacturer and become responsible for the applicable Article 13 and Article 14 obligations.

02 / 09

Writing the Code Is Not Automatically the Manufacturer Test

Technical authorship and CRA manufacturer status are not identical. The person who writes source code is not automatically the manufacturer. The Regulation also covers a person that has a product designed or developed and then markets it under its own identity. Product responsibility, commissioning and market identity therefore matter alongside the physical act of software development.

03 / 09

An Employee Developer Normally Acts for the Employer

Where employees develop a software product as part of their employment and the employing company markets the product under the company's name or trademark, the CRA manufacturer analysis normally concerns the legal entity marketing the product rather than each individual developer. Engineering responsibility inside an organisation should therefore be distinguished from the legal manufacturer role.

04 / 09

A Contractor Can Develop Software Without Becoming the Manufacturer

A development agency or independent contractor can write substantial parts of a product while another company remains the CRA manufacturer. Article 3 expressly contemplates a person having a product designed or developed. If the customer commissions the software and markets the resulting product under its own name or trademark, outsourcing development does not by itself move manufacturer responsibility to the contractor.

05 / 09

A Development Agency Can Also Market Its Own Product

The result changes where the development agency itself creates a product and markets it under its own identity. In that case the agency may satisfy the manufacturer definition directly. Teams should assess each product arrangement instead of assuming that a company described commercially as an agency, consultancy or developer can never be a manufacturer.

06 / 09

The Software Publisher May Be the Relevant Manufacturer

A software publisher can commission employees, contractors and external suppliers while retaining product responsibility and branding. Where the publisher has the product designed or developed and markets it under its name or trademark, the CRA manufacturer role can belong to that publisher. Copyright ownership alone is not the statutory manufacturer test, although it may be relevant evidence in understanding the arrangement.

07 / 09

Free of Charge Does Not Prevent Manufacturer Status

The manufacturer definition expressly covers products marketed for payment, monetisation or free of charge. A developer that supplies a zero-price commercial software product can therefore still be the manufacturer. Qualifying free and open-source software requires the CRA's additional open-source analysis, but price by itself does not determine the manufacturer role.

08 / 09

Substantial Modification Can Change the Manufacturer Analysis

A developer that was not the original manufacturer can later assume manufacturer obligations if it substantially modifies a product and makes the modified product available on the market in circumstances covered by Article 22. The role analysis should therefore be repeated when a developer forks, customises or materially changes an existing product for market supply.

09 / 09

Document Product Responsibility, Not Just Development Responsibility

For every software product, identify the legal entity that commissions development, the developers and contractors, the entity that controls release, the entity whose name or trademark appears on the product and the entity that makes it available on the market. The resulting CRA manufacturer record should explain why that entity is responsible for the marketed product.

REFERENCE DESK

Official sources

Read the full legal text and Commission material for precise wording, qualifications and updates.

Editorial review: 26 September 2026. Regulatory material can change; follow the official sources for current guidance.