Distributor verification is narrower than importer verification but still needs a repeatable intake or release process. Distributors should check the required product and operator information, preserve supplier records and maintain escalation routes for non-conformity, vulnerabilities and significant cybersecurity risk.
Act With Due Care
Article 20 begins with a general due-care obligation. A distributor should therefore use a controlled process for CRA-covered products rather than assuming that compliance is solely the upstream supplier's concern.
Verify CE Marking
Before making the product available, verify that it bears CE marking. Missing CE marking should trigger a hold and supplier escalation rather than proceeding with ordinary sale.
Verify Specified Manufacturer Obligations
Article 20 points distributors to specified manufacturer duties covering product and manufacturer information, user information, support information and the declaration of conformity. The distributor should verify that the required materials have been provided.
Verify Importer Identification Where Applicable
Where an importer is involved, verify the Article 19(4) importer identification information. This helps preserve the EU supply-chain identity for products from non-EU manufacturers.
Do Not Reproduce the Manufacturer's Engineering Assessment
The distributor's role is verification and due care, not repeating the manufacturer's cybersecurity risk assessment or conformity assessment. The distributor should nevertheless react to obvious gaps or credible information indicating non-compliance.
Stop Supply When Non-Conformity Is Suspected
If the distributor considers or has reason to believe the product or manufacturer processes are not in conformity with Annex I, it must not make the product available until conformity has been restored.
Escalate Significant Cybersecurity Risk
Where the product presents a significant cybersecurity risk, the distributor has notification duties toward the manufacturer and relevant market surveillance authorities.
Maintain a Distributor Release Checklist
A practical checklist should record CE marking, required manufacturer and importer information, documents received, supplier identity, escalation decisions and the person approving release.
Official sources
Read the full legal text and Commission material for precise wording, qualifications and updates.