Non-EU manufacturers need to prepare for the same core CRA product-security lifecycle obligations that apply to manufacturers generally when their products fall within scope and are placed on the Union market. The cross-border supply chain adds EU importer, possible authorised-representative and Article 14 reporting-routing questions, but those roles do not automatically replace the original manufacturer.
The CRA Manufacturer Definition Does Not Require EU Establishment
Article 3 does not require that the manufacturer be established in the Union. A company established in a third country can therefore remain the CRA manufacturer where it develops or manufactures a product with digital elements, or has it designed, developed or manufactured, and markets that product under its name or trademark for the Union market.
Non-EU Manufacturers Still Carry Article 13 Duties
Where the product is within CRA scope, the manufacturer's location outside the Union does not remove the core Article 13 responsibilities. The manufacturer must ensure Annex I compliance, perform and document the cybersecurity risk assessment, exercise due diligence for integrated components, operate vulnerability handling processes, determine the support period, prepare technical documentation and complete the applicable conformity assessment.
Manufacturer Identification Must Still Be Provided
Article 13 requires manufacturer identification and contact details to appear on the product, packaging or an accompanying document, and to be included in the Annex II information and instructions. A non-EU manufacturer should therefore ensure that its legal identity and the required postal and digital contact information are consistently available to users and market surveillance authorities.
The Manufacturer Needs a Single Point of Contact
Article 13 also requires manufacturers to designate a single point of contact so users can communicate directly and rapidly with them, including for vulnerability reporting. The CRA does not confine that requirement to manufacturers established in the Union. Non-EU manufacturers therefore need a usable product-security contact route for EU users.
An EU Importer Has Separate Article 19 Responsibilities
Article 3 defines an importer as a person established in the Union that places on the market a product with digital elements bearing the name or trademark of a person established outside the Union. The importer must perform the Article 19 verification, identification, corrective-action, record-retention and authority-cooperation duties. The importer role does not automatically transfer the original manufacturer's Article 13 obligations; Article 19 duties operate as additional supply-chain controls.
An Authorised Representative Is a Separate Role
Article 18 allows a manufacturer to appoint an authorised representative established in the Union through a written mandate. The authorised representative can perform specified regulatory-interface tasks, but Article 18 expressly excludes core manufacturer obligations from the mandate. Appointment of a representative therefore does not convert the representative into the manufacturer or eliminate the non-EU manufacturer's underlying CRA responsibilities.
The CRA Does Not Automatically Require the Importer to Become Manufacturer
A normal importer remains an importer while the third-country company remains the manufacturer. Article 21 changes that position only in specified circumstances, including where the importer places the product on the market under its own name or trademark or substantially modifies an already marketed product. Importing alone does not create the Article 21 manufacturer role.
Article 14 Reporting Also Covers Manufacturers Without an EU Main Establishment
Article 14 contains a specific reporting-routing rule where the manufacturer has no main establishment in the Union. The manufacturer still has the Article 14 notification obligations. The Regulation determines the relevant CSIRT coordinator using an order based on the manufacturer's authorised representative, importer, distributor and, if necessary, the location of the highest number of users.
EU Market Access Requires Supply-Chain Evidence
A non-EU manufacturer should ensure that the EU importer has the conformity and product information Article 19 requires it to verify. That includes the applicable conformity assessment, technical documentation, CE marking, EU declaration of conformity, Annex II information, manufacturer identification and support-period information. Cross-border access to evidence should be established before market placement.
Market Surveillance Cooperation Still Reaches the Manufacturer
Article 13 requires manufacturers to respond to reasoned market-surveillance requests and cooperate on measures to eliminate cybersecurity risks posed by products they placed on the market. A non-EU location should therefore not be treated as an operational reason to lose access to technical documentation, product records or the people needed to respond to EU authority requests.
Prepare the EU Market Route Before Launch
Before supplying an in-scope product into the Union, document the legal manufacturer, EU importer where applicable, authorised representative if one has been appointed, product identification, conformity evidence, vulnerability contact, support-period information and Article 14 reporting route. This cross-border role map should be maintained for each product rather than handled only as a general corporate-market-access document.
Official sources
Read the full legal text and Commission material for precise wording, qualifications and updates.