Independent information resource Product security · EU CRA
CRA importers and distributors / Pillar

CRA Requirements for Importers and Distributors

A practical guide to Cyber Resilience Act requirements for importers and distributors, including pre-market verification, CE marking, declarations, non-conformity, traceability and manufacturer-role changes.

IN BRIEF

Importer and distributor obligations are narrower than the manufacturer's full lifecycle duties but still operationally significant. Market-access processes should verify product evidence before sale, block non-compliant products, preserve traceability and detect situations where an importer or distributor becomes the manufacturer under Article 21.

01 / 09

Importers and Distributors Perform Different CRA Roles

An importer is established in the Union and places on the market a product bearing the name or trademark of a person established outside the Union. A distributor is another person in the supply chain that makes the product available on the Union market without affecting its properties. Those definitions create different verification points.

02 / 09

Importers Must Place Only Compliant Products on the Market

Article 19 requires importers to place only products that comply with Annex I Part I and where the manufacturer's processes comply with Annex I Part II. This creates a pre-market gate rather than a duty to wait for authorities to identify non-compliance later.

03 / 09

Importer Checks Cover Conformity and Documentation

Before market placement, the importer must ensure that the appropriate conformity assessment has been carried out, technical documentation has been drawn up, CE marking is present and the product is accompanied by the required EU declaration of conformity and user information.

04 / 09

Distributors Must Act With Due Care

Article 20 requires distributors to act with due care and verify CE marking plus specified manufacturer and importer obligations before making the product available. The distributor is not expected to reproduce the manufacturer's engineering work, but it cannot ignore missing or obviously defective compliance evidence.

05 / 09

Non-Conformity Must Stop Market Activity

Where the importer or distributor has reason to believe the product or manufacturer processes are non-compliant, the CRA requires action before further market activity. Depending on the role and circumstances, that can include withholding the product, corrective measures, withdrawal or recall.

06 / 09

Vulnerabilities Trigger Supply-Chain Duties

Importers and distributors that become aware of a vulnerability must inform the manufacturer without undue delay. Significant cybersecurity risk can also require notification to market surveillance authorities.

07 / 09

Article 21 Can Turn the Operator Into the Manufacturer

An importer or distributor is considered the manufacturer where it places the product on the market under its own name or trademark or substantially modifies a product already placed on the market. At that point Articles 13 and 14 apply.

08 / 09

Article 23 Requires Traceability

Economic operators must be able, on request, to identify who supplied them and, where available, who they supplied. The information must be available for 10 years after receipt and for 10 years after supply.

09 / 09

Market Access Should Be a Repeatable Process

Build a controlled checklist covering role identification, conformity evidence, CE marking, declarations, user information, manufacturer and importer identification, support information, traceability records and escalation for non-conformity or substantial modification.

REFERENCE DESK

Official sources

Read the full legal text and Commission material for precise wording, qualifications and updates.

Editorial review: 26 September 2026. Regulatory material can change; follow the official sources for current guidance.