Rebranding is not merely a marketing issue under the CRA. An importer or distributor that takes market ownership of the product by placing it on the market under its own identity can become the manufacturer and assume the corresponding cybersecurity, conformity, documentation, reporting and post-market responsibilities.
Article 21 Creates an Own-Brand Manufacturer Rule
Article 21 states that an importer or distributor shall be considered to be a manufacturer where that importer or distributor places a product with digital elements on the market under its own name or trademark. Once that condition is met, the operator is subject to Articles 13 and 14 rather than remaining only within the ordinary importer or distributor role.
The Rule Applies Even Without Redesigning the Product
The own-brand limb of Article 21 is separate from the substantial-modification limb. An importer or distributor can therefore become the manufacturer because of how it places the product on the market even where the underlying product has not been technically redesigned. Own-brand supply needs its own CRA role assessment.
Private-Label Products Need Manufacturer-Level Evidence
A private-label seller that becomes the CRA manufacturer needs access to the evidence required to perform manufacturer obligations. That can include the cybersecurity risk assessment, component information, technical documentation, conformity evidence, support-period decisions and vulnerability-handling information. A commercial agreement that provides only finished units may be insufficient for the operator's new legal role.
Articles 13 and 14 Become Relevant
Article 21 expressly makes the own-brand importer or distributor subject to Articles 13 and 14. This means the role change can bring the product-security lifecycle, conformity, vulnerability-handling and CRA reporting obligations that apply to manufacturers. The operator should therefore identify the role transition before it places the own-brand product on the Union market.
Software Rebranding Can Raise the Same Issue
The rule is not confined to physical hardware. Software products with digital elements can also be marketed under another company's identity. White-label software, private-label applications and rebranded digital products should therefore be assessed to determine which legal entity is placing the product on the market under its name or trademark.
An Ordinary Reseller Does Not Automatically Become Manufacturer
A distributor that resells a product under the original manufacturer's identity can remain a distributor where the facts satisfy that role. Article 21 becomes relevant where the operator itself places the product on the market under its own name or trademark or carries out a substantial modification. Merely appearing on an invoice as reseller is not the same issue as assuming the product's market identity.
Supplier Contracts Should Support the New Role
Where a company plans an own-brand arrangement, procurement and supply contracts should provide enough technical and lifecycle information for the company to perform manufacturer duties. The contract cannot remove obligations created by Article 21. Product access, vulnerability information, update responsibilities and conformity evidence should therefore be addressed before launch.
The Product Should Carry Consistent Manufacturer Information
Once the own-brand operator is the manufacturer for CRA purposes, its product documentation and compliance records need to reflect that role consistently. Manufacturer identity, user information, conformity documentation, vulnerability contact information and related evidence should not conflict with the legal role assumed through the own-brand market placement.
Official sources
Read the full legal text and Commission material for precise wording, qualifications and updates.