The CRA manufacturer role follows responsibility for the marketed product rather than authorship alone. Development work can be performed internally or externally while the company that commissions and markets the product remains the manufacturer. The correct assessment identifies the product, the entity controlling its market identity and the relationship between that entity and the people who develop it.
Developer Is Not a Defined CRA Economic-Operator Role
The CRA defines manufacturer, authorised representative, importer and distributor, but developer is not a separate defined economic-operator category. Development activity is still highly relevant because the manufacturer definition expressly refers to developing a product or having it developed. The legal role therefore cannot be assigned from the job title developer alone.
The Manufacturer Definition Includes Direct Development
A natural or legal person that develops a product with digital elements and markets that product under its own name or trademark can satisfy the Article 3 manufacturer definition. A software company that designs, develops and publishes its own application can therefore be both the developer in an ordinary technical sense and the manufacturer for CRA purposes.
The Manufacturer Definition Also Includes Commissioned Development
Article 3 also covers a person that has products with digital elements designed, developed or manufactured. A company can therefore remain the manufacturer when it commissions another organisation to perform development and then markets the resulting product under its own name or trademark. Outsourcing technical work does not by itself transfer the legal manufacturer role.
An Employee Developer Is Usually Not a Separate Manufacturer
Where an employee develops part of a product for an employing company and that company markets the resulting product under its own identity, the manufacturer analysis concerns the company responsible for the marketed product rather than automatically treating every individual developer as a manufacturer. Internal technical accountability and the CRA economic-operator role are different questions.
A Contractor Is Not Automatically the Manufacturer
A contractor or development agency may write code, design hardware or test cybersecurity controls without becoming the manufacturer of the customer's product. The contractor can still have responsibilities under its commercial agreement or for separate products that it places on the market, but technical contribution alone does not automatically establish manufacturer status.
Branding and Market Identity Matter
The Article 3 manufacturer definition expressly includes marketing the product under the person's own name or trademark. The role assessment should therefore identify which legal entity appears as the manufacturer in product information, conformity records, sales material and the product's market identity. Internal labels such as platform team, engineering owner or software publisher are not substitutes for that analysis.
The Manufacturer Carries the Article 13 Lifecycle Duties
Once the manufacturer has been identified, Article 13 places the main product cybersecurity duties on that entity. These include Annex I compliance, the cybersecurity risk assessment, component due diligence, vulnerability handling, support-period decisions, technical documentation, conformity assessment and post-market corrective obligations. Development teams can perform the technical work needed to satisfy those duties, but the obligations attach to the manufacturer.
A Developer Can Later Become Manufacturer Through Its Own Product
A contractor that initially develops software for another company can separately become a manufacturer if it later develops and markets its own product under its own name or trademark. CRA roles are therefore assigned product by product rather than permanently assigning one company the label developer or manufacturer.
Substantial Modification Can Also Change the Role
Articles 21 and 22 can create manufacturer obligations for persons that substantially modify products already placed on the market in the circumstances defined by the Regulation. A developer that customises or forks an existing product and commercially supplies the modified product should therefore assess whether the modification creates a manufacturer role.
Record Both the Developer and the Legal Manufacturer
A practical product record should identify the legal manufacturer separately from the development teams and suppliers. Record who commissions development, who performs it, who controls product release, whose name or trademark the product carries and which entity places or makes the product available on the market. This avoids confusing technical ownership with the CRA manufacturer role.
Official sources
Read the full legal text and Commission material for precise wording, qualifications and updates.