CRA Importer Obligations — Third Country Products in EU

Key numbers

mandatory verification checks for importers under Article 19(2) before market placement

10 years

minimum period importers must keep the EU declaration of conformity available — Art. 19(6)

€10M

maximum fine for importers failing Article 19 obligations — Art. 64(3)

How CRACheck works

You enter your product data. CRACheck structures the documentation per Article 31 + Annex VII.

Understand your role

Article 3 defines an importer as any person established in the Union who places a product from a third country on the EU market. If you sell under your own brand, Article 21 reclassifies you as the manufacturer.

Verify manufacturer compliance

Before market placement, Article 19(2) requires you to confirm conformity assessment, technical documentation, CE marking with Annex II user information, and manufacturer identification.

Document your verification

CRACheck generates the documentation package that reflects the eight points of Annex VII. Use it as a template to verify your supplier's file.

Add your own identification

Article 19(4) requires importers to indicate their name, trade name, postal and email addresses on the product, packaging, or accompanying document.

Monitor post-market

Article 19(5) obligates you to take corrective action if you learn the product does not conform after market placement.

Retain documentation

Article 19(6): keep a copy of the EU declaration of conformity for at least 10 years after market placement or for the support period, whichever is longer.

Notify if manufacturer ceases operations

Article 19(8): if the manufacturer goes out of business, inform market surveillance authorities and affected users.

Common mistakes

❌

ARTICLE 21 TRAP

"Putting your brand on a third-country product without realising you become the manufacturer"

Article 21 of Regulation (EU) 2024/2847 is explicit: an importer who places a product on the market under its own name or trademark becomes the manufacturer for the purposes of the Regulation and must comply with all obligations under Articles 13 and 14. This includes full technical documentation, risk assessment, and vulnerability handling.

❌

VERIFICATION FAILURE

"Accepting CE marking at face value without checking the underlying documentation"

Article 19(2) requires importers to verify not just the presence of CE marking but the completion of conformity assessment procedures, the existence of technical documentation, and compliance with Article 13(15), (16), and (19). CE marking without the underlying file is an empty declaration, and Article 19(3) prohibits you from placing the product until it is brought into conformity.

❌

NOTIFICATION

"Not reporting a vulnerability discovered in an imported product"

Article 19(5), second subparagraph, requires importers who become aware of a vulnerability in a product they have placed on the market to inform the manufacturer without undue delay. If the product presents a significant cybersecurity risk, importers must immediately inform the market surveillance authorities of all Member States where the product was made available.

What the ZIP contains

8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.

Product Classifier

Identifies where the imported product sits in the CRA classification. Critical for importers: if the product is Important Class I/II (Annex III) and the manufacturer has not applied harmonised standards, you need to verify that EU-type examination has been performed per Article 32(2)–(3).

Technical Documentation

Structured per Annex VII. As an importer, you use this as the reference structure to verify completeness of your supplier's technical file. Any gaps mean the product cannot be placed on the market under Article 19(3).

Risk Assessment

The cybersecurity risk assessment that Article 13(2) and (3) require from the manufacturer. As an importer, verify this exists and covers the specified elements.

User Information

Annex II checklist. Article 19(2)(c) requires you to verify that the product is accompanied by user information in a user-understandable language.

Declaration of Conformity

Per Article 28 and Annex V. Article 19(6) requires you to keep a copy at the disposal of authorities for at least 10 years or the support period.

CVD Policy

Verify that the manufacturer has a coordinated vulnerability disclosure policy per Part II, point (5) of Annex I. If absent, the product does not meet the essential requirements.

Notification Template

Article 14 notification structure. While the manufacturer bears the primary notification duty, Article 19(5) places an independent obligation on you to inform the manufacturer and authorities. Art. 14(2): early warning within 24h, notification within 72h, final report within 14 days.

Obligations Calendar

Key dates for importers: Art. 14 manufacturer reporting from 11 September 2026, full CRA enforcement 11 December 2027, your 10-year documentation retention period.

Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.

Generated from your data, in your browser. No data leaves your device.

What you pay

🧾 IMPORT COMPLIANCE REVIEW BY A LAW FIRM

€8,000–€15,000

4–8 weeks per product line. Review must be repeated for each new product or supplier. No standard template — each firm has its own format. No automated update when regulation evolves.

✓ CRACHECK

€149

8 documents. 15–25 min. Generates the Annex VII reference structure you need to audit your suppliers. 30 days to refine. Regenerate if regulation changes. Pack 10: €99/unit. Pack 30: €79/unit.

Two layers

● LAYER 1

Documentation verification baseline

CRACheck generates the full documentation structure that Article 31 and Annex VII require. As an importer, you use this output as the benchmark to audit your third-country supplier's technical file. Every missing element in the supplier's file is a point where Article 19(3) blocks you from market placement.

∅ LAYER 2

Verification, monitoring, and escalation

CRACheck does not conduct physical inspection of the imported product. It does not verify that the manufacturer's factory processes match the documentation. It does not perform the vulnerability scanning or penetration testing that may be needed to validate the risk assessment. Those steps are your due diligence under Article 19.

The documentation baseline tells you what to look for. CRACheck builds that baseline. The verification itself is your obligation as the importer.

Enforcement regime

Article 64 of Regulation (EU) 2024/2847.

🔴

Manufacturer obligations if Art. 21 applies (Art. 64(2))

€15,000,000 / 2.5%

If you become the manufacturer under Article 21, all Article 13 and 14 penalties apply.

🟠

Importer obligations (Art. 64(3))

€10,000,000 / 2%

Non-compliance with importer obligations under Article 19.

🟡

Misleading information (Art. 64(4))

€5,000,000 / 1%

Providing incorrect or misleading information to market surveillance authorities.

Alternatives

Criterion	Trust the supplier	In-house legal review	External law firm	CRACheck
Article 19(2) coverage	None	Partial, depends on expertise	Full, but €8K–€15K	Full, automated
Time per product	0 (and maximum risk)	20–60 hours	4–8 weeks	15–25 minutes
Supplier audit template	None	Custom, inconsistent	Custom	Standardised per Annex VII
Regulatory update handling	Not tracked	Manual	New engagement	Free regeneration

Importing multiple product lines from different suppliers?

Each product line needs independent documentation verification. Pack of 10: €99 per product. Pack of 30: €79 per product.

Request Volume Pricing

Use each generated set as a verification checklist against your supplier's technical file.

What CRACheck guarantees and what it does not

CRACheck generates a structured document based on Article 31 and Annex VII of Regulation (EU) 2024/2847 from the information you provide. The accuracy and completeness is your responsibility as the importer or as the manufacturer if Article 21 applies.

We guarantee that the document structure follows Article 31 and Annex VII and that all cited legal references are correct. We do not guarantee that a specific document will satisfy a market surveillance authority in a particular enforcement action or that your supplier's compliance is adequate.

CRACheck is not legal advice. For specific import compliance questions, consult a lawyer specialising in EU product regulation.

Frequently asked questions

If the manufacturer is outside the EU, who is responsible for the technical documentation?

Article 13(12) places the obligation on the manufacturer. However, Article 19(2)(b) requires the importer to verify that this documentation exists before placing the product on the EU market. If the manufacturer has not produced it, Article 19(3) prohibits you from market placement. If you sell the product under your own brand, Article 21 makes you the manufacturer and you must produce the documentation yourself.

What if I discover after import that the product has a vulnerability?

Article 19(5) requires importers to inform the manufacturer without undue delay upon becoming aware of a vulnerability. If the product presents a significant cybersecurity risk, you must immediately inform the market surveillance authorities of every Member State where the product was made available.

Do the €15M fines apply to importers?

The €15M/2.5% tier under Article 64(2) applies to violations of Articles 13 and 14, which are manufacturer obligations. If Article 21 reclassifies you as the manufacturer, these penalties apply to you. Importer-specific obligations under Article 19 fall under Article 64(3): up to €10M or 2% of global turnover.

How long must I keep the documentation?

Article 19(6) requires importers to keep a copy of the EU declaration of conformity at the disposal of market surveillance authorities for at least 10 years after market placement or for the support period, whichever is longer.

Is this a subscription?

No. One-time payment. 30 days editing, 10 regenerations. PDF yours permanently.

Can I request a refund?

Per Article 16(m) of Directive (EU) 2011/83, licence activation constitutes express consent. Refunds only for reproducible technical failures.

What if the regulation changes?

Regenerate with the updated version at no additional cost during licence validity.

Official legal sources

Regulation (EU) 2024/2847 — Article 19 — Obligations of importers
Regulation (EU) 2024/2847 — Article 21 — When importers/distributors become manufacturers

⚠️ Important notice: CRACheck is a self-assessment documentation tool, not legal advice and not a third-party audit. The document under Article 31 and Annex VII of Regulation (EU) 2024/2847 is generated from your input data. You are responsible for the accuracy of the data you provide. CRACheck does not replace a qualified professional assessment.