Independent information resource Product security · EU CRA
CRA importers and distributors / 10

When an Importer Becomes the Manufacturer

When Article 21 makes a CRA importer the manufacturer because it uses its own name or trademark or substantially modifies a product already placed on the market.

IN BRIEF

Own-brand and substantial-modification decisions can radically change an importer's CRA obligations. Market-access teams should therefore perform a role-change review before private-label launch or material product modification rather than assuming the organisation remains only an importer.

01 / 08

Article 21 Defines the Role Change

An importer is considered to be a manufacturer for CRA purposes where it places the product on the market under its own name or trademark or carries out a substantial modification of a product already placed on the market.

02 / 08

Own-Brand Market Placement Is Enough

The own-name or trademark limb is separate from substantial modification. An importer can therefore become manufacturer because of market identity even where it did not redesign the underlying product.

03 / 08

Substantial Modification Is the Other Trigger

A substantial modification can also trigger manufacturer status. The assessment should use the CRA definition and consider whether the change affects Annex I compliance or the intended purpose for which the product was assessed.

04 / 08

Article 13 Manufacturer Duties Then Apply

The role change brings manufacturer lifecycle obligations including cybersecurity risk assessment, Annex I compliance, technical documentation, vulnerability handling, support-period duties and conformity assessment.

05 / 08

Article 14 Reporting Also Applies

An Article 21 importer-manufacturer becomes subject to the manufacturer reporting obligations in Article 14. Incident and vulnerability escalation therefore needs to reflect the new legal role.

06 / 08

Supplier Contracts Need Enough Technical Access

A private-label importer becoming manufacturer needs sufficient technical and security evidence from the original supplier to perform manufacturer duties. A contract that provides only finished units may be insufficient.

07 / 08

Update Product and Compliance Identity

Manufacturer identification, conformity records, declarations and product information should reflect the legal role created by the own-brand or modification arrangement.

08 / 08

Perform the Role Review Before Launch

Build a mandatory Article 21 review into private-label, rebranding and major customisation workflows so the organisation understands the new obligations before market placement.

REFERENCE DESK

Official sources

Read the full legal text and Commission material for precise wording, qualifications and updates.

Editorial review: 26 September 2026. Regulatory material can change; follow the official sources for current guidance.