CRA Distributor Obligations in the EU Supply Chain

Key numbers

Art. 20

imposes 6 distinct obligations on distributors in the EU supply chain

Art. 21

reclassifies distributors as manufacturers when they sell under their own brand or substantially modify

€10M

maximum fine for distributor non-compliance — Article 64(3)

How CRACheck works

You enter your product data. CRACheck structures the documentation per Article 31 + Annex VII.

Determine your CRA role

Article 3 distinguishes manufacturers, importers, and distributors. If you sell under your own brand or modify the product, Article 21 reclassifies you.

Verify CE marking

Article 20(2)(a): before making the product available, check that it bears CE marking per Article 30.

Verify manufacturer and importer compliance

Article 20(2)(b): confirm that the manufacturer has complied with Article 13(15)–(16), (18)–(20), and that the importer has complied with Article 19(4).

Assess conformity concerns

Article 20(3): if you have reason to believe the product does not conform, do not make it available until it is brought into conformity.

Monitor post-distribution

Article 20(4): if you learn of non-compliance after distribution, take corrective action or withdraw/recall. Inform the manufacturer of any vulnerability.

Cooperate with authorities

Article 20(5): upon request, provide all information and documentation necessary to demonstrate conformity.

Notify if manufacturer ceases operations

Article 20(6): if you learn the manufacturer has gone out of business, inform market surveillance authorities and affected users.

Common mistakes

❌

PASSIVITY

"Treating distribution as a logistics-only function under the CRA"

Article 20 imposes active verification obligations. Article 20(2) requires checking CE marking and manufacturer/importer compliance before making the product available. Article 20(3) prohibits distribution if non-conformity is suspected. "We just move boxes" is not a defence under the CRA.

❌

OWN BRAND

"Rebranding a product without realising you become the manufacturer"

Article 21 states that an importer or distributor who places a product on the market under its own name or trademark becomes the manufacturer for the purposes of the Regulation, subject to all obligations in Articles 13 and 14. Private-label and white-label products trigger full manufacturer responsibilities.

❌

VULNERABILITY

"Not reporting a vulnerability in a distributed product"

Article 20(4), second subparagraph, requires distributors who become aware of a vulnerability to inform the manufacturer without undue delay. If the product presents a significant cybersecurity risk, distributors must immediately inform market surveillance authorities.

What the ZIP contains

8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.

Product Classifier

Determines the product category for each product you distribute. Understanding classification helps you assess the adequacy of the manufacturer's conformity assessment approach.

Technical Documentation

The Annex VII reference structure. As a distributor, you use this as a checklist to evaluate whether the manufacturer's technical file is complete.

Risk Assessment

Reference structure per Article 13(2)–(3). Understanding what a proper risk assessment looks like helps you assess manufacturer documentation during Article 20(3) due diligence.

User Information

Annex II reference. Article 20(2)(b) requires you to verify that the manufacturer has provided Annex II information.

Declaration of Conformity

Per Article 28 and Annex V. The declaration is the document behind the CE marking.

CVD Policy

Reference for what a manufacturer's vulnerability handling process should include per Part II of Annex I.

Notification Template

Article 14 reference structure. Article 20(4) may require you to inform authorities independently of significant cybersecurity risks. Art. 14(2): early warning within 24h, notification within 72h, final report within 14 days.

Obligations Calendar

Key dates relevant to distributors: full CRA enforcement, documentation retention expectations, ongoing monitoring obligations.

Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.

Generated from your data, in your browser. No data leaves your device.

What you pay

🧾 SUPPLY CHAIN COMPLIANCE AUDIT BY A LAW FIRM

€10,000–€25,000

4–12 weeks per product category. No standardised checklist. New engagement for each new supplier or product line.

✓ CRACHECK

€149

€149 per product. 15–25 min. Generates the reference structure you compare against your supplier's file. Standardised per Annex VII. Regenerate when regulation evolves.

Two layers

● LAYER 1

A structured verification baseline

CRACheck generates the documentation structure that the CRA requires from manufacturers. As a distributor, you use this output as the standard against which you evaluate whether the manufacturer's file meets Article 31 and Annex VII. Gaps in the manufacturer's file relative to the CRACheck reference mean gaps in their compliance.

∅ LAYER 2

Verification, monitoring, and escalation are your responsibilities

CRACheck does not inspect the manufacturer's actual file. It does not audit the manufacturer's production processes or security implementation. It does not perform the Article 20(3) assessment of whether you have "reason to believe" the product does not conform. Those judgments are yours as the distributor.

CRACheck shows you what compliant documentation looks like. You compare it to what the manufacturer gives you. The comparison is the core of your Article 20 due diligence.

Enforcement regime

Article 64 of Regulation (EU) 2024/2847.

🔴

Manufacturer obligations if Art. 21 applies (Art. 64(2))

€15,000,000 / 2.5%

If Article 21 reclassifies you as the manufacturer, all Article 13/14 penalties apply.

🟠

Distributor obligations (Art. 64(3))

€10,000,000 / 2%

Non-compliance with distributor obligations under Article 20.

🟡

Misleading information (Art. 64(4))

€5,000,000 / 1%

Providing misleading information to market surveillance authorities.

Alternatives

Criterion	No verification process	Informal supplier audit	External compliance firm	CRACheck reference baseline
Art. 20(2) coverage	None	Partial	Full, but €10K+	Full reference structure
Time per product line	0 (maximum risk)	Days	4–12 weeks	15–25 minutes
Standardisation	None	Inconsistent	Custom per firm	Standardised per Annex VII
Scalability across suppliers	Not applicable	Limited	Expensive	€99–€149 per product

Distributing products from multiple manufacturers?

Each product line from each manufacturer benefits from its own documentation reference. Pack of 10: €99 per product. Pack of 30: €79 per product.

Request Volume Pricing

Use each set as a verification checklist during supplier onboarding.

What CRACheck guarantees and what it does not

CRACheck generates a structured document based on Article 31 and Annex VII of Regulation (EU) 2024/2847 from the data you provide. For distributors using CRACheck as a verification reference, the output represents the documentation standard, not a certification of the manufacturer's actual compliance.

We guarantee that the document structure follows Article 31 and Annex VII and that all cited legal references are correct. We do not guarantee that the manufacturer's actual file is compliant nor that a market surveillance authority will accept your verification process.

CRACheck is not legal advice. For supply chain compliance strategy, consult a qualified legal professional.

Frequently asked questions

Am I a distributor or an importer under the CRA?

Article 3 distinguishes the two: an importer places a product from a third country on the EU market for the first time. A distributor makes a product available on the market after it has already been placed. If you buy from a non-EU manufacturer and bring the product into the EU, you are the importer (Article 19). If you buy from an EU manufacturer or another EU importer and resell, you are a distributor (Article 20).

What happens if I sell the product under my own brand?

Article 21 reclassifies you as the manufacturer. All obligations in Articles 13 and 14 apply to you: technical documentation, risk assessment, conformity assessment, declaration of conformity, CE marking, vulnerability handling, and ENISA notification. The penalty tier shifts from €10M/2% to €15M/2.5%.

Must I keep copies of the manufacturer's documentation?

Article 20 does not require distributors to keep copies of the full technical documentation, but Article 20(5) requires you to provide all information necessary to demonstrate conformity upon request. Maintaining a record of your verification checks and a copy of the EU declaration of conformity is prudent.

Can a distributor be fined even if the manufacturer is the one at fault?

Yes. Article 64(3) applies independently to distributor obligations under Article 20. A distributor who fails to verify CE marking, or who distributes a product despite having reason to believe it is non-compliant, faces fines of up to €10,000,000 or 2% of global turnover regardless of the manufacturer's separate liability.

Is this a subscription?

No. One-time payment. 30 days editing, 10 regenerations. PDF yours permanently.

Can I request a refund?

Per Article 16(m) of Directive (EU) 2011/83, licence activation constitutes express consent. Refunds only for reproducible technical failures.

What if the regulation changes?

Regenerate at no additional cost during licence validity.

Official legal sources

Regulation (EU) 2024/2847 — Article 20 — Obligations of distributors
Regulation (EU) 2024/2847 — Article 21 — When importers/distributors become manufacturers

⚠️ Important notice: CRACheck is a self-assessment documentation tool, not legal advice and not a third-party audit. The document under Article 31 and Annex VII of Regulation (EU) 2024/2847 is generated from your input data. You are responsible for the accuracy of the data you provide. CRACheck does not replace a qualified professional assessment.