CRA Importer & Distributor Obligations

Key numbers

Art. 19

7 specific obligations for importers before placing a product on the EU market

Art. 20

5 specific obligations for distributors in the EU supply chain

€10M

Maximum fine for non-compliance with importer/distributor obligations (Art. 64(3))

How CRACheck works

You enter your product data. CRACheck structures the documentation per Article 31 + Annex VII.

Determine your role

Are you the importer (first entity placing the product on the EU market) or the distributor (making an already-placed product available further in the supply chain)? The obligations differ.

Verify manufacturer compliance

Before you place the product on the EU market, Article 19(2) requires you to verify: (a) conformity assessment completed, (b) technical documentation exists, (c) CE marking and declaration of conformity are present, (d) user information in Annex II is in an understandable language.

If documentation is missing: contact the manufacturer

Share CRACheck with your manufacturer. At €149 per product, the cost of producing documentation is minimal compared to the risk of placing an undocumented product on the EU market.

Add your identification

Article 19(4) requires importers to indicate their name, registered trade name or trademark, and contact address on the product or packaging.

Maintain documentation

Article 19(6) requires importers to keep the EU declaration of conformity available for at least 10 years or the support period, whichever is longer.

Monitor and act

Article 19(5) requires importers who become aware of non-compliance to take corrective action: bring the product into compliance, withdraw, or recall. Notify market surveillance authorities if the product presents a significant cybersecurity risk.

Cooperate with authorities

Article 19(7) requires importers to provide documentation to market surveillance authorities upon reasoned request.

Common mistakes

❌

IMPORTER OBLIGATIONS

"We are just reselling — the manufacturer is responsible for everything"

Article 19 of Regulation (EU) 2024/2847 creates independent obligations for importers. You must verify documentation exists, add your contact information to the product, maintain copies of the declaration, and act on non-compliance. These obligations exist whether or not the manufacturer has fulfilled theirs. Placing a product without documentation on the EU market is your violation, not just the manufacturer's.

❌

VERIFICATION DUTY

"We import products from a well-known brand — they must be compliant"

Article 19(2) requires you to ensure compliance before market placement — not to assume it based on brand reputation. "Ensure" means you have verified the existence of conformity assessment, technical documentation, CE marking, and declaration of conformity. If you cannot produce these documents upon request, you are non-compliant regardless of the manufacturer's reputation.

❌

SUPPLY CHAIN TIMING

"We will start verifying documentation in 2027 when enforcement begins"

EU importers who wait until December 2027 to verify manufacturer documentation face a supply chain crisis: if their manufacturers have not produced documentation, the products cannot legally be placed on the EU market. Lead time for manufacturer documentation is months, not days. Starting verification now ensures continuity of supply.

What the ZIP contains

8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.

Product Classifier

If you need your manufacturer to produce documentation, share CRACheck. The classifier determines the Annex III category and conformity assessment path.

Technical Documentation

Art. 31 + Annex VII. This is what you must verify exists before placing the product on the EU market (Art. 19(2)(b)).

Risk Assessment

Part of the technical documentation. Your manufacturer must produce it (Art. 13(2)-(3)).

User Information

Annex II. You must verify it exists and is in a language understandable by EU users (Art. 19(2)(c)).

Declaration of Conformity

Art. 28 + Annex V. You must keep a copy at the disposal of market surveillance authorities for 10 years (Art. 19(6)).

CVD Policy

Part of the manufacturer's obligations. Your verification includes confirming vulnerability handling processes exist.

Notification Template

Art. 14. The manufacturer's obligation, but you must inform them without undue delay about vulnerabilities you become aware of (Art. 19(5)). Art. 14(2): early warning within 24h, notification within 72h, final report within 14 days.

Obligations Calendar

Timeline for both manufacturer and importer obligations.

Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.

Generated from your data, in your browser. No data leaves your device.

What you pay

🧾 PLACE PRODUCTS WITHOUT DOCUMENTATION

€0 upfront

Risk: €10,000,000 fine or 2% global turnover (Art. 64(3)). Plus: product withdrawal, supply chain disruption, and reputational damage with EU customers.

✓ CRACHECK

€149

Share CRACheck with your manufacturer → €149 per product. 15–25 min. The manufacturer produces the documentation you need to verify. Your supply chain continues.

Two layers

● LAYER 1

Manufacturer Documentation (CRACheck)

CRACheck helps your manufacturer produce the Article 31 documentation that you, as importer, need to verify under Article 19(2). By sharing CRACheck with your suppliers, you enable low-cost documentation production across your product portfolio.

∅ LAYER 2

Your Importer Obligations (Not CRACheck)

CRACheck does not fulfill your importer-specific obligations: adding your contact information to products (Art. 19(4)), maintaining documentation copies (Art. 19(6)), acting on non-compliance (Art. 19(5)), and cooperating with authorities (Art. 19(7)). These are operational obligations your compliance team manages.

CRACheck solves the manufacturer documentation gap. Your import compliance processes handle the rest.

Enforcement regime

Article 64 of Regulation (EU) 2024/2847.

🟠

Importer/distributor obligations (Art. 64(3))

€10,000,000 / 2%

Importer and distributor obligations under Articles 19-20. This is the primary enforcement tier for importers and distributors.

🔴

Substantial modification → becomes manufacturer (Art. 64(2))

€15,000,000 / 2.5%

If an importer substantially modifies a product (Art. 22), they become the manufacturer.

🟡

Misleading information (Art. 64(4))

€5,000,000 / 1%

Misleading information to authorities.

Alternatives

Criteria	Ignore CRA obligations	Hire import compliance firm	Internal compliance team	CRACheck for manufacturers
Manufacturer documentation available	Unknown	They verify but don't produce	They verify but don't produce	Yes — manufacturers produce for €149
Cost to you	€0 + risk	€20K-€50K for compliance program	Staff hours	€149 per product (share with manufacturer)
Supply chain continuity risk	High	Low	Medium	Low
Time to resolve documentation gap	N/A	8-16 weeks	4-8 weeks	15-25 min per product

You import dozens of products from multiple manufacturers?

Share CRACheck with each manufacturer. At €149 per product (or €99 in packs of 10, €79 in packs of 30), your manufacturers can produce the documentation you need to verify across your entire product portfolio.

Request Volume Pricing

Response within 24 business hours.

What CRACheck guarantees and what it does not

CRACheck generates structured manufacturer documentation according to Article 31 and Annex VII of Regulation (EU) 2024/2847. The accuracy of the information is the manufacturer's responsibility.

We guarantee the document structure follows Article 31 + Annex VII and legal references are correct. We do not guarantee that specific documents will satisfy a market surveillance authority's verification.

CRACheck is not legal advice. For importer-specific compliance questions, consult a qualified EU trade compliance attorney.

Frequently asked questions

What is the difference between an importer and a distributor under CRA?

Article 3(16) defines an importer as a person established in the EU who places a product from a third country on the EU market. Article 3(17) defines a distributor as a person in the supply chain who makes a product available on the EU market without being the manufacturer or importer. The importer is the first EU entity in the chain; the distributor is any subsequent entity. Importers have more extensive obligations under Article 19 than distributors under Article 20.

We are a US company that imports into the EU through a subsidiary. Who is the importer?

Your EU subsidiary, if it is the entity that places the product on the EU market, is the importer under Article 3(16). The importer must be established in the EU. If you have no EU entity, the entity that first places the product on the EU market — your EU customer or a logistics partner — may become the importer and bear the corresponding obligations.

What happens if our manufacturer refuses to provide CRA documentation?

Article 19(3) prohibits importers from placing on the EU market products they consider or have reason to believe are not in conformity. If your manufacturer cannot provide evidence of conformity assessment, technical documentation, and declaration of conformity, you cannot legally import the product. Share CRACheck (€149 per product) as a cost-effective alternative — or find a CRA-compliant alternative manufacturer.

If we modify a product (rebranding, firmware customization), do we become the manufacturer?

Article 22 of Regulation (EU) 2024/2847 states that a person who carries out a substantial modification and makes the product available on the market is considered the manufacturer. Minor rebranding is unlikely to constitute a substantial modification. Firmware customization that affects cybersecurity compliance may qualify. If you become the manufacturer, full Article 13 obligations apply.

We distribute products that are already on the EU market. What must we check?

Article 20 requires distributors to verify: (a) the CE marking is on the product, (b) the EU declaration of conformity and Annex II user information accompany the product, and (c) the manufacturer and importer have complied with identification requirements. If you become aware of non-compliance, you must take corrective action and notify authorities.

Is CRACheck a subscription?

No. One-time payment. 30 days of editing, 10 regenerations. The PDF is yours to keep.

Can I request a refund?

Per Article 16(m) of Directive (EU) 2011/83, activating the license constitutes express consent for immediate generation. Refunds only for reproducible technical failures.

What if the regulation changes?

Regenerate at no additional cost during your license period.

Official legal sources

Regulation (EU) 2024/2847 — Cyber Resilience Act

⚠️ Important notice: CRACheck is a self-assessment documentation tool, not legal advice and not a third-party audit. The document under Article 31 and Annex VII of Regulation (EU) 2024/2847 is generated from your input data. You are responsible for the accuracy of the data you provide. CRACheck does not replace a qualified professional assessment.