Independent information resource Product security · EU CRA
CRA importers and distributors / 03

CRA Requirements for Products Manufactured Outside the EU

How the Cyber Resilience Act applies when products with digital elements are manufactured outside the EU and enter the Union market through an EU importer.

IN BRIEF

Non-EU market access depends on a clear role map and evidence flow. The manufacturer needs the required conformity and technical evidence, while the EU importer must verify specified obligations before placing the product on the market and preserve its own identification and authority-response responsibilities.

01 / 08

Manufacturer Location Does Not Remove CRA Responsibility

The CRA manufacturer definition does not require establishment in the Union. A non-EU company can therefore remain the manufacturer of an in-scope product supplied to the Union market.

02 / 08

An EU Importer Is Usually the Market-Entry Operator

Article 3 defines the importer as an EU-established person that places on the market a product bearing the name or trademark of a person established outside the Union. The importer becomes the practical EU market-entry checkpoint.

03 / 08

The Non-EU Manufacturer Still Needs CRA Product Evidence

The manufacturer remains responsible for applicable Article 13 duties, including Annex I compliance, the cybersecurity risk assessment, technical documentation, conformity assessment, support-period obligations and product information.

04 / 08

The Importer Must Verify Before Market Placement

Article 19 requires the importer to ensure the specified conformity assessment, technical documentation, CE marking, declaration and user information are in place before market placement.

05 / 08

Importer Identification Must Be Added

The importer must provide its own name and contact information without obscuring the manufacturer information or required product information.

06 / 08

Evidence Must Be Accessible Across Borders

A practical supply arrangement should ensure that the importer can obtain the conformity and product information needed for its checks and authority cooperation. Cross-border contracts should not leave key evidence inaccessible after sale.

07 / 08

Authorised Representative and Importer Are Different Roles

A manufacturer may appoint an authorised representative by written mandate, but that role is separate from the importer. The two roles can coexist and should not be treated as interchangeable.

08 / 08

Plan for Manufacturer Cessation

If the importer learns that the manufacturer has ceased operations and can no longer comply with the CRA, Article 19 requires notification to relevant market surveillance authorities and, to the extent possible, affected users.

REFERENCE DESK

Official sources

Read the full legal text and Commission material for precise wording, qualifications and updates.

Editorial review: 26 September 2026. Regulatory material can change; follow the official sources for current guidance.