Independent information resource Product security · EU CRA
CRA economic operators / 05

Who Is Considered the Manufacturer of a Software Product?

Understand who is considered the manufacturer of a software product under the Cyber Resilience Act, including software publishers, outsourced development, own branding, free distribution and role changes.

IN BRIEF

The CRA manufacturer role follows responsibility for the marketed software product rather than job title alone. A company can be the manufacturer even when contractors write the code, while a developer working for another company's product is not automatically the manufacturer. The decisive facts include who has the product developed, whose name or trademark it bears and how it is placed on the market.

01 / 10

Article 3 Defines Manufacturer Broadly Enough for Software

Article 3 defines a manufacturer as a natural or legal person that develops or manufactures products with digital elements, or has those products designed, developed or manufactured, and markets them under its name or trademark, whether for payment, monetisation or free of charge. Because software is a product with digital elements when the CRA scope conditions are satisfied, the same manufacturer definition applies to software products.

02 / 10

The Person Writing the Code Is Not Automatically the Manufacturer

Software development and CRA manufacturer status are related but not identical concepts. A developer can write all or part of the code for a product that another company has designed or commissioned and markets under that company's name or trademark. In that arrangement, the company responsible for the marketed product can be the manufacturer even though another person performed much of the technical development.

03 / 10

A Company Can Be Manufacturer When Development Is Outsourced

The manufacturer definition expressly covers a person that has products with digital elements designed or developed. A software company therefore cannot avoid manufacturer status merely by outsourcing engineering to an agency, contractor or overseas development team. If the company has the software developed and markets the resulting product under its own identity, the CRA manufacturer analysis points to that company.

04 / 10

Branding Is a Central Part of the Role Analysis

The CRA definition refers to marketing the product under the person's name or trademark. Product teams should therefore identify the legal entity whose identity appears on the marketed software product, licence, conformity information, website and associated product materials. Commercial descriptions such as publisher, platform owner or vendor can be useful operationally, but the CRA role should be mapped against the statutory manufacturer definition.

05 / 10

Payment Is Not Required for Manufacturer Status

Article 3 expressly states that a manufacturer can market a product for payment, monetisation or free of charge. A zero-price software product therefore does not automatically lack a manufacturer. The CRA contains specific treatment for free and open-source software, so qualifying FOSS needs that additional analysis, but ordinary free commercial software should not be excluded from the manufacturer assessment simply because users do not pay a purchase price.

06 / 10

A Software Publisher Can Be the Manufacturer

Where a software publisher controls the product, has it developed and markets it under its own name or trademark, it can satisfy the CRA manufacturer definition even where employees, contractors and third-party components contribute to the product. The manufacturer role is therefore broader than authorship of source code and should be assigned to the relevant legal entity rather than to an individual engineering team.

07 / 10

An Ordinary Reseller Is Normally a Different Economic Operator

A company that merely distributes another manufacturer's software without affecting its properties does not become the manufacturer simply because it sells licences or provides the product to customers. Depending on the supply chain it can instead be a distributor or importer. The role changes, however, if the operator places the product on the market under its own name or trademark or substantially modifies it.

08 / 10

Own-Brand Supply Can Transfer Manufacturer Obligations

Article 21 provides that an importer or distributor is considered the manufacturer where it places a product with digital elements on the market under its own name or trademark. This rule prevents an operator from taking commercial ownership of a product while treating the original supplier as solely responsible for CRA manufacturer obligations. A later article in this cluster examines own-brand arrangements in detail.

09 / 10

Substantial Modification Can Create a New Manufacturer Role

Article 21 also treats an importer or distributor as manufacturer where it substantially modifies an already marketed product. Article 22 applies a similar principle to another person that carries out a substantial modification and makes the modified product available on the market. Software forks, major functional changes and customised deployments therefore need a role assessment where the modification could meet the CRA substantial-modification test.

10 / 10

Map the Manufacturer to the Product, Not the Organisation Chart

For each software product, record the legal entity that commissions or controls development, the entity whose name or trademark appears on the product, the development contractors, component suppliers, distributor and importer where relevant, and any entity that substantially modifies the software. The CRA manufacturer conclusion should follow those product and market facts rather than internal labels such as engineering owner, copyright owner or software vendor.

REFERENCE DESK

Official sources

Read the full legal text and Commission material for precise wording, qualifications and updates.

Editorial review: 26 September 2026. Regulatory material can change; follow the official sources for current guidance.