Distributor response starts with stopping further supply and escalating upstream. The distributor needs enough traceability to identify affected stock and customers, coordinate corrective action and meet authority or user-notification duties where required.
Stop Making the Product Available
Article 20 requires the distributor not to make the product available where it has reason to believe the product or manufacturer processes are not in conformity with Annex I until conformity has been restored.
Inform the Manufacturer and Importer as Appropriate
Escalate the issue through the supply chain so the manufacturer and importer can investigate the affected product and coordinate corrective action.
Take Corrective Action for Products Already Supplied
Where non-conformity becomes known after the product has been made available, the distributor must ensure necessary corrective measures are taken. Depending on the facts, these can include bringing the product into conformity, withdrawal or recall.
Notify Authorities for Significant Cybersecurity Risk
Where the product presents a significant cybersecurity risk, the distributor must immediately inform relevant market surveillance authorities and provide details of the non-compliance and corrective measures.
Report Vulnerabilities to the Manufacturer
A distributor that becomes aware of a vulnerability must inform the manufacturer without undue delay. Vulnerability information should be routed through a monitored security and compliance escalation path.
Use Inventory and Customer Records
Identify affected stock, product versions, upstream supplier and downstream recipients where available. This makes withdrawal, recall or targeted communication operationally possible.
Document the Response
Record why supply was stopped, who was notified, which products were affected, what corrective measures were taken and when normal distribution resumed.
Handle Manufacturer Cessation
If the distributor becomes aware that the manufacturer has ceased operations and cannot comply with the CRA, it must inform relevant market surveillance authorities without undue delay and, to the extent possible, affected users.
Official sources
Read the full legal text and Commission material for precise wording, qualifications and updates.