If the manufacturer is outside the EU, who is responsible for the technical documentation?

Article 13(12) places the obligation on the manufacturer. However, Article 19(2)(b) requires the importer to verify that this documentation exists before placing the product on the EU market. If the manufacturer has not produced it, Article 19(3) prohibits you from market placement. If you sell the product under your own brand, Article 21 makes you the manufacturer and you must produce the documentation yourself.

Do the €15M fines apply to importers?

The €15M/2.5% tier under Article 64(2) applies to violations of Articles 13 and 14, which are manufacturer obligations. If Article 21 reclassifies you as the manufacturer, these penalties apply to you. Importer-specific obligations under Article 19 fall under Article 64(3): up to €10M or 2% of global turnover.

How long must I keep the documentation?

Article 19(6) requires importers to keep a copy of the EU declaration of conformity at the disposal of market surveillance authorities for at least 10 years after market placement or for the support period, whichever is longer.

Is this a subscription?

No. One-time payment. 30 days editing, 10 regenerations. PDF yours permanently.

Can I request a refund?

Per Article 16(m) of Directive (EU) 2011/83, licence activation constitutes express consent. Refunds only for reproducible technical failures.

What if the regulation changes?

Regenerate with the updated version at no additional cost during licence validity.

You import connected products manufactured outside the European Union. Article 19 of Regulation (EU) 2024/2847 does not let you simply forward the manufacturer's CE declaration. You must verify conformity assessment, technical documentation, and CE marking before placing that product on the EU market. If the manufacturer has not done the work, Article 21 makes you the manufacturer.

Q: What if I discover after import that the product has a vulnerability?

Article 19(5) requires importers to inform the manufacturer without undue delay upon becoming aware of a vulnerability. If the product presents a significant cybersecurity risk, you must immediately inform the market surveillance authorities of every Member State where the product was made available.

The Cyber Resilience Act creates a verification gate for importers. Article 19(2) lists four conditions you must confirm before placing a third-country product on the EU market: conformity assessment completed per Article 32, technical documentation drawn up per Article 31, CE marking affixed per Article 30 with Annex II user information, and manufacturer identification per Article 13(15)–(16). If any condition fails, Article 19(3) prohibits you from placing the product until the manufacturer brings it into conformity. CRACheck helps you generate the documentation baseline that your suppliers must meet — and the evidence that you verified it. Eight documents, 15–25 minutes, €149.

Generate importer documentation — €149 Free: check your product classification

€149 one-time · 8-document ZIP · 15–25 minutes · Browser-side

Key numbers

mandatory verification checks for importers under Article 19(2) before market placement

10 years

minimum period importers must keep the EU declaration of conformity available — Art. 19(6)

€10M

maximum fine for importers failing Article 19 obligations — Art. 64(3)

How CRACheck works

You enter your product data. CRACheck structures the documentation per Article 31 + Annex VII.

Understand your role

Article 3 defines an importer as any person established in the Union who places a product from a third country on the EU market. If you sell under your own brand, Article 21 reclassifies you as the manufacturer.

Verify manufacturer compliance

Before market placement, Article 19(2) requires you to confirm conformity assessment, technical documentation, CE marking with Annex II user information, and manufacturer identification.

Document your verification

CRACheck generates the documentation package that reflects the eight points of Annex VII. Use it as a template to verify your supplier's file.

Add your own identification

Article 19(4) requires importers to indicate their name, trade name, postal and email addresses on the product, packaging, or accompanying document.

Monitor post-market

Article 19(5) obligates you to take corrective action if you learn the product does not conform after market placement.

Retain documentation

Article 19(6): keep a copy of the EU declaration of conformity for at least 10 years after market placement or for the support period, whichever is longer.

Notify if manufacturer ceases operations

Article 19(8): if the manufacturer goes out of business, inform market surveillance authorities and affected users.

Common mistakes

❌

ARTICLE 21 TRAP

"Putting your brand on a third-country product without realising you become the manufacturer"

Article 21 of Regulation (EU) 2024/2847 is explicit: an importer who places a product on the market under its own name or trademark becomes the manufacturer for the purposes of the Regulation and must comply with all obligations under Articles 13 and 14. This includes full technical documentation, risk assessment, and vulnerability handling.

❌

VERIFICATION FAILURE

"Accepting CE marking at face value without checking the underlying documentation"

Article 19(2) requires importers to verify not just the presence of CE marking but the completion of conformity assessment procedures, the existence of technical documentation, and compliance with Article 13(15), (16), and (19). CE marking without the underlying file is an empty declaration, and Article 19(3) prohibits you from placing the product until it is brought into conformity.

❌

NOTIFICATION

"Not reporting a vulnerability discovered in an imported product"

Article 19(5), second subparagraph, requires importers who become aware of a vulnerability in a product they have placed on the market to inform the manufacturer without undue delay. If the product presents a significant cybersecurity risk, importers must immediately inform the market surveillance authorities of all Member States where the product was made available.

What the ZIP contains

8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.

Product Classifier

Identifies where the imported product sits in the CRA classification. Critical for importers: if the product is Important Class I/II (Annex III) and the manufacturer has not applied harmonised standards, you need to verify that EU-type examination has been performed per Article 32(2)–(3).

Technical Documentation

Structured per Annex VII. As an importer, you use this as the reference structure to verify completeness of your supplier's technical file. Any gaps mean the product cannot be placed on the market under Article 19(3).

Risk Assessment

The cybersecurity risk assessment that Article 13(2) and (3) require from the manufacturer. As an importer, verify this exists and covers the specified elements.

User Information

Annex II checklist. Article 19(2)(c) requires you to verify that the product is accompanied by user information in a user-understandable language.

Declaration of Conformity

Per Article 28 and Annex V. Article 19(6) requires you to keep a copy at the disposal of authorities for at least 10 years or the support period.

CVD Policy

Verify that the manufacturer has a coordinated vulnerability disclosure policy per Part II, point (5) of Annex I. If absent, the product does not meet the essential requirements.

Notification Template

Article 14 notification structure. While the manufacturer bears the primary notification duty, Article 19(5) places an independent obligation on you to inform the manufacturer and authorities. Art. 14(2): early warning within 24h, notification within 72h, final report within 14 days.

Obligations Calendar

Key dates for importers: Art. 14 manufacturer reporting from 11 September 2026, full CRA enforcement 11 December 2027, your 10-year documentation retention period.

Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.

Generated from your data, in your browser. No data leaves your device.

What you pay

🧾 IMPORT COMPLIANCE REVIEW BY A LAW FIRM

€8,000–€15,000

4–8 weeks per product line. Review must be repeated for each new product or supplier. No standard template — each firm has its own format. No automated update when regulation evolves.

✓ Last regulatory check: 1 May 2026 · No substantive changes detected · View history