For distributors ยท Regulation (EU) 2024/2847

What the CRA requires of distributors and resellers

Verified against the Official Journal text on

If you make a product with digital elements available on the EU market without affecting its properties, you are a distributor under the CRA (Art. 3(17)). Your duties are lighter than a manufacturer's or importer's, but real: act with due care, verify the product bears the CE marking and that the manufacturer and importer met their key duties before you pass it on, and pass vulnerability information up the chain (Art. 20). Rebrand the product under your own name, or modify it substantially, and you become the manufacturer instead (Art. 21).

Basis: Art. 3(17), Art. 20, Art. 21

Act with due care, and check before you pass it on Art. 20(1), Art. 20(2)

When making a product available on the market, a distributor must act with due care in relation to the requirements of the CRA (Art. 20(1)). Before making it available, you must verify the product bears the CE marking, and that the manufacturer and importer have complied with their identification, contact, instructions, support-period, and declaration duties and provided you the necessary documents (Art. 20(2)).

This is a lighter, verification-level duty than the manufacturer's: you are not assessing conformity yourself, you are checking the visible signs that others did their job before the product reaches you.

Hold back non-conforming products Art. 20(3), Art. 20(4)

Where you consider or have reason to believe, on the basis of information in your possession, that a product or the manufacturer's processes are not in conformity, you must not make it available until it is brought into conformity; where it poses a significant cybersecurity risk you must, without undue delay, inform the manufacturer and the market surveillance authorities (Art. 20(3)).

If a product you have already made available turns out to be non-conforming, you must make sure the necessary corrective measures are taken, or that it is withdrawn or recalled as appropriate (Art. 20(4)).

Vulnerability, cooperation, and cessation duties Art. 20(4), Art. 20(5), Art. 20(6)

On becoming aware of a vulnerability in the product, you must inform the manufacturer without undue delay; where the product presents a significant cybersecurity risk, you must immediately inform the market surveillance authorities of the Member States where you made it available (Art. 20(4)). On a reasoned request, you must provide the information and documentation needed to demonstrate conformity, and cooperate with the authority (Art. 20(5)).

If you become aware that the manufacturer has ceased operations and can no longer comply, you must inform the relevant market surveillance authorities without undue delay and, so far as possible, the users of the products already placed on the market (Art. 20(6)).

The own-brand and substantial-modification trap Art. 21

The distributor role ends the moment you change your relationship to the product. Placing it on the market under your own name or trademark, or carrying out a substantial modification, makes you a manufacturer for the purposes of the CRA, subject to Articles 13 and 14 in full (Art. 21). Reselling or distributing a product unchanged, under the original brand, keeps you in the lighter distributor role.

What you must do

  • Act with due care: before making a product available, verify it bears the CE marking and that manufacturer and importer met their key duties. (Art. 20(1), Art. 20(2))
  • On becoming aware of a vulnerability in the product, inform the manufacturer without undue delay; where the product presents a significant cybersecurity risk, immediately inform the market surveillance authorities. (Art. 20(4))
  • Selling under your own name or trademark, or substantial modification, makes the manufacturer obligations yours. (Art. 21)

The dates that decide your planning

11 December 2027
The distributor obligations apply from this date, alongside the manufacturer and importer duties they verify: CE marking, declaration of conformity, and user information. Reporting under Article 14 is a manufacturer duty, not a distributor one, unless you become the manufacturer under Article 21. (Art. 71(2))

Frequently asked

What is the difference between a distributor and an importer?

An importer is established in the EU and is the first to place a non-EU maker's product on the EU market. A distributor is anyone else in the supply chain who makes a product available without affecting its properties. Distributors carry lighter due-care duties than importers. (Art. 3(16), Art. 3(17))

Do distributors have to report vulnerabilities to ENISA?

No. The Article 14 reporting duty via the single reporting platform sits with the manufacturer. As a distributor you inform the manufacturer of vulnerabilities without undue delay, and inform market surveillance authorities where the product presents a significant cybersecurity risk. (Art. 20(4), Art. 14)

What must we check before reselling a product?

That the product bears the CE marking, and that the manufacturer and importer met their identification, contact, user-instruction, support-period, and declaration duties and gave you the necessary documents. You verify these signs; you do not assess conformity yourself. (Art. 20(2))

When do the distributor duties start?

The distributor obligations apply from 11 December 2027, the same date the manufacturer and importer duties they depend on take effect. There is no earlier reporting trigger for distributors, because Article 14 reporting is a manufacturer duty. (Art. 71(2))

Confirm your role, free

The Vexwatch Scope Checker walks the same cited decision tree in about three minutes and tells you whether you are a distributor, an importer, or already treated as the manufacturer.

Check your scope, free See the Blueprint

This page is general information about Regulation (EU) 2024/2847, the EU Cyber Resilience Act. It is compliance tooling, not legal advice, and creates no client relationship. It may not reflect your specific circumstances or the most recent regulatory guidance. Verify conclusions against the regulation or qualified counsel before relying on them.