What is the difference between an importer and a distributor under CRA?

Article 3(16) defines an importer as a person established in the EU who places a product from a third country on the EU market. Article 3(17) defines a distributor as a person in the supply chain who makes a product available on the EU market without being the manufacturer or importer. The importer is the first EU entity in the chain; the distributor is any subsequent entity. Importers have more extensive obligations under Article 19 than distributors under Article 20.

We are a US company that imports into the EU through a subsidiary. Who is the importer?

Your EU subsidiary, if it is the entity that places the product on the EU market, is the importer under Article 3(16). The importer must be established in the EU. If you have no EU entity, the entity that first places the product on the EU market — your EU customer or a logistics partner — may become the importer and bear the corresponding obligations.

If we modify a product (rebranding, firmware customization), do we become the manufacturer?

Article 22 of Regulation (EU) 2024/2847 states that a person who carries out a substantial modification and makes the product available on the market is considered the manufacturer. Minor rebranding is unlikely to constitute a substantial modification. Firmware customization that affects cybersecurity compliance may qualify. If you become the manufacturer, full Article 13 obligations apply.

We distribute products that are already on the EU market. What must we check?

Article 20 requires distributors to verify: (a) the CE marking is on the product, (b) the EU declaration of conformity and Annex II user information accompany the product, and (c) the manufacturer and importer have complied with identification requirements. If you become aware of non-compliance, you must take corrective action and notify authorities.

Is CRACheck a subscription?

No. One-time payment. 30 days of editing, 10 regenerations. The PDF is yours to keep.

Can I request a refund?

Per Article 16(m) of Directive (EU) 2011/83, activating the license constitutes express consent for immediate generation. Refunds only for reproducible technical failures.

What if the regulation changes?

Regenerate at no additional cost during your license period.

You import or distribute products with digital elements into the European Union from third-country manufacturers. Articles 19 and 20 of Regulation (EU) 2024/2847 impose specific obligations on importers and distributors — separate from and additional to the manufacturer's obligations. You cannot place a product on the EU market without verifying the manufacturer has produced Article 31 documentation. If they have not, you share the compliance gap. CRACheck helps manufacturers produce that documentation — but this page explains what you, as the importer or distributor, must verify and do.

Q: What happens if our manufacturer refuses to provide CRA documentation?

Article 19(3) prohibits importers from placing on the EU market products they consider or have reason to believe are not in conformity. If your manufacturer cannot provide evidence of conformity assessment, technical documentation, and declaration of conformity, you cannot legally import the product. Share CRACheck (€149 per product) as a cost-effective alternative — or find a CRA-compliant alternative manufacturer.

The Cyber Resilience Act creates a chain of responsibility. The manufacturer (Article 13) produces the technical documentation and declares conformity. The importer (Article 19) verifies the manufacturer has done so before placing the product on the EU market. The distributor (Article 20) verifies the CE marking and declaration are in place. If you are a US company importing products from a third-country manufacturer into the EU, you are the importer under Article 19 — and your obligations are specific, verifiable, and enforceable. CRACheck generates the manufacturer's documentation at €149 per product; this page explains what you must do with it.

Share CRACheck with your manufacturer — €149 Free: check your product classification

€149 one-time · 8-document ZIP · 15–25 minutes · Browser-side

Key numbers

Art. 19

7 specific obligations for importers before placing a product on the EU market

Art. 20

5 specific obligations for distributors in the EU supply chain

€10M

Maximum fine for non-compliance with importer/distributor obligations (Art. 64(3))

How CRACheck works

You enter your product data. CRACheck structures the documentation per Article 31 + Annex VII.

Determine your role

Are you the importer (first entity placing the product on the EU market) or the distributor (making an already-placed product available further in the supply chain)? The obligations differ.

Verify manufacturer compliance

Before you place the product on the EU market, Article 19(2) requires you to verify: (a) conformity assessment completed, (b) technical documentation exists, (c) CE marking and declaration of conformity are present, (d) user information in Annex II is in an understandable language.

If documentation is missing: contact the manufacturer

Share CRACheck with your manufacturer. At €149 per product, the cost of producing documentation is minimal compared to the risk of placing an undocumented product on the EU market.

Add your identification

Article 19(4) requires importers to indicate their name, registered trade name or trademark, and contact address on the product or packaging.

Maintain documentation

Article 19(6) requires importers to keep the EU declaration of conformity available for at least 10 years or the support period, whichever is longer.

Monitor and act

Article 19(5) requires importers who become aware of non-compliance to take corrective action: bring the product into compliance, withdraw, or recall. Notify market surveillance authorities if the product presents a significant cybersecurity risk.

Cooperate with authorities

Article 19(7) requires importers to provide documentation to market surveillance authorities upon reasoned request.

Common mistakes

❌

IMPORTER OBLIGATIONS

"We are just reselling — the manufacturer is responsible for everything"

Article 19 of Regulation (EU) 2024/2847 creates independent obligations for importers. You must verify documentation exists, add your contact information to the product, maintain copies of the declaration, and act on non-compliance. These obligations exist whether or not the manufacturer has fulfilled theirs. Placing a product without documentation on the EU market is your violation, not just the manufacturer's.

❌

VERIFICATION DUTY

"We import products from a well-known brand — they must be compliant"

Article 19(2) requires you to ensure compliance before market placement — not to assume it based on brand reputation. "Ensure" means you have verified the existence of conformity assessment, technical documentation, CE marking, and declaration of conformity. If you cannot produce these documents upon request, you are non-compliant regardless of the manufacturer's reputation.

❌

SUPPLY CHAIN TIMING

"We will start verifying documentation in 2027 when enforcement begins"

EU importers who wait until December 2027 to verify manufacturer documentation face a supply chain crisis: if their manufacturers have not produced documentation, the products cannot legally be placed on the EU market. Lead time for manufacturer documentation is months, not days. Starting verification now ensures continuity of supply.

What the ZIP contains

8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.

Product Classifier

If you need your manufacturer to produce documentation, share CRACheck. The classifier determines the Annex III category and conformity assessment path.

Technical Documentation

Art. 31 + Annex VII. This is what you must verify exists before placing the product on the EU market (Art. 19(2)(b)).

Risk Assessment

Part of the technical documentation. Your manufacturer must produce it (Art. 13(2)-(3)).

User Information

Annex II. You must verify it exists and is in a language understandable by EU users (Art. 19(2)(c)).

Declaration of Conformity

Art. 28 + Annex V. You must keep a copy at the disposal of market surveillance authorities for 10 years (Art. 19(6)).

CVD Policy

Part of the manufacturer's obligations. Your verification includes confirming vulnerability handling processes exist.

Notification Template

Art. 14. The manufacturer's obligation, but you must inform them without undue delay about vulnerabilities you become aware of (Art. 19(5)). Art. 14(2): early warning within 24h, notification within 72h, final report within 14 days.

Obligations Calendar

Timeline for both manufacturer and importer obligations.

Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.

Generated from your data, in your browser. No data leaves your device.

What you pay

🧾 PLACE PRODUCTS WITHOUT DOCUMENTATION

€0 upfront

Risk: €10,000,000 fine or 2% global turnover (Art. 64(3)). Plus: product withdrawal, supply chain disruption, and reputational damage with EU customers.

✓ Last regulatory check: 1 May 2026 · No substantive changes detected · View history