An OEM contract does not by itself decide who the CRA manufacturer is. The role depends on who is responsible for the marketed product, whose name or trademark it carries, whether another operator is separately placing a component or product on the market, and whether Article 21 changes an importer or distributor into the manufacturer.
OEM Is Not a Defined CRA Economic-Operator Role
OEM is not a defined CRA economic-operator role. It is a commercial and supply-chain label whose meaning can vary between industries and contracts. The CRA instead defines manufacturer, authorised representative, importer, distributor and other relevant persons. An OEM arrangement therefore has to be translated into those statutory roles before responsibilities can be allocated.
The Brand Owner Can Be the CRA Manufacturer
Article 3 defines manufacturer broadly enough to include a natural or legal person that develops or manufactures a product with digital elements or has the product designed, developed or manufactured and markets it under its own name or trademark. A company can therefore remain the manufacturer even where an OEM supplier performs the physical manufacturing, software development or integration work.
The OEM Supplier Is Not Automatically the Finished-Product Manufacturer
A supplier may perform extensive technical work without necessarily being the CRA manufacturer of the finished product marketed by its customer. The analysis should identify whose product is being placed on the market and whose name or trademark it bears. Engineering responsibility and CRA manufacturer status can overlap, but they are not identical concepts.
The OEM Supplier Can Have Its Own CRA Product Responsibilities
The supplier should also be assessed independently for anything it places on the market itself. If it supplies a separately marketed component or another product with digital elements under its own identity, that product can create its own CRA manufacturer obligations. The finished-product manufacturer's responsibilities do not automatically absorb the supplier's separate legal position.
Article 21 Matters in Own-Brand Arrangements
Article 21 is particularly important where an importer or distributor places an existing product with digital elements on the market under its own name or trademark. In that situation the importer or distributor is considered to be the manufacturer and becomes subject to Articles 13 and 14. OEM and private-label arrangements should therefore be reviewed before the own-brand product is launched.
Manufacturer Due Diligence Still Covers Integrated Components
Article 13 requires the manufacturer to exercise due diligence when integrating components sourced from third parties so that those components do not compromise product cybersecurity. An OEM relationship does not remove this due diligence obligation. The finished-product manufacturer needs enough component, version and vulnerability information to assess and maintain the product securely.
The Manufacturer Needs Access to Technical Documentation Evidence
A manufacturer relying on an OEM supplier still needs to prepare and maintain the technical documentation required by the CRA. Supplier-generated architecture records, test results, component information and design evidence may be important inputs, but the manufacturer needs durable access to the evidence necessary for its own conformity position and authority requests.
Vulnerability Information Must Flow Across the Relationship
The manufacturer remains responsible for effective vulnerability handling for the marketed product during the support period. OEM contracts and operational processes should therefore support timely vulnerability notification, affected-version identification, remediation information and security-update coordination between the supplier and the manufacturer.
Conformity Responsibility Must Match the Marketed Product
The CRA conformity assessment, EU declaration of conformity, CE marking and manufacturer information should correspond to the entity that actually carries the manufacturer role for the marketed product. A supply arrangement in which technical evidence identifies one product owner while market documentation identifies another should be resolved before market placement.
Contracts Support Compliance but Do Not Replace the CRA Role Test
Contracts can allocate engineering work, evidence delivery, vulnerability communication, testing, update development and indemnities between commercial parties. However, contracts do not replace the statutory role analysis. The CRA manufacturer determination should be recorded separately using the product, branding, development and market-placement facts.
Official sources
Read the full legal text and Commission material for precise wording, qualifications and updates.