This CRA FAQ helps identify the manufacturer, authorised representative, importer, distributor, or EU-based responsible operator for a product with digital elements, then map the checks and evidence each role must hold.
Built for legal, compliance, supply-chain, marketplace, and go-to-market teams assigning CRA role ownership before products are placed on or made available in the Union market.
Structured answer sets in this page tree.
Cited legal and guidance references.
Assign the CRA role from what each business does for the specific product and transaction, not from its contract label. The brand owner or substantial modifier can become the ; the first EU supplier of a third-country product is usually the ; later suppliers are distributors; and an performs only the tasks in its written mandate. The main operator duties generally apply from 11 December 2027, while Article 14 reporting starts on 11 September 2026.
Under the CRA, an means the , , , , or another natural or legal person that is subject to obligations relating to the manufacture of products with digital elements or to their making available on the market under the Regulation.
Article 3(12)
Map the manufacturer, importer, distributor, authorised representative, Article 4 responsible operator, and evidence owner for each product with digital elements before Union-market release.
The CRA defines them as separate roles:
- the develops, manufactures, or has the product designed, developed or manufactured, and markets it under its own name or trademark
- the is an EU-established person with a written mandate from the to act on specified tasks
- the is an EU-established person who places on the market a product bearing the name or trademark of a person established outside the Union
- the is a person in the supply chain, other than the or , who makes the product available on the Union market without affecting its properties
Article 3(13), Article 3(15)-(17)
Yes.
The CRA recognises that the same business can perform different functions depending on the product and the service it provides. A business that only provides online intermediation for one product may not be a CRA for that product, while the same business could still be a or a for other products that it actually sells or brands.
recital 78
Yes.
The CRA definition covers both the actor that developed or assembled the product and the business that markets it under its own name or trademark. A business that places the product on the market under its own brand takes the role for CRA purposes.
Article 3(13), recital 78
section 3.1
Not in every case.
Article 18 says a may appoint an by written mandate, so the appointment is optional under the CRA itself. But where the manufacturer is established outside the Union, a CRA-covered product can only be placed on the Union market if there is an EU-established operator performing the tasks required by Article 4 of Regulation (EU) 2019/1020.
Article 18(1)
section 4.6.1
No.
The Commission FAQ explains that a non-EU needs an established in the Union to perform the Article 4 tasks under Regulation (EU) 2019/1020. Depending on the setup, that can be an , an or, where no other such operator exists, a .
section 4.6.1
The performs the tasks specified in the written mandate from the . At minimum, that mandate must allow it to:
- keep the EU declaration of conformity and technical documentation at the disposal of market surveillance authorities
- provide the relevant information and documentation to market surveillance authorities on request
The must also provide a copy of its mandate to market surveillance authorities on request.
Article 18(3)
The cannot take over the 's core product-compliance obligations listed in Article 13(1) to (11), Article 13(12), first subparagraph, and Article 13(14).
That means the can help with documentation and authority-facing tasks, but it does not supersede the for the core design, risk assessment, conformity assessment and ongoing compliance duties that the CRA keeps with the manufacturer.
Article 18(2)-(3)
Before placing a product on the market, the must ensure that:
- the carried out the appropriate conformity assessment
- the drew up the technical documentation
- the product bears the CE marking and is accompanied by the declaration of conformity and Annex II information and instructions in an understandable language
- the complied with the identification, contact-detail and support-period-end-date obligations in Article 13(15), (16) and (19)
Article 19(1)-(2)
If the considers or has reason to believe that the product or the 's processes are not in conformity, it must not place the product on the market until conformity is restored.
If the product presents a significant cybersecurity risk, the must inform the and the market surveillance authorities. After placement on the market, if the importer becomes aware of a vulnerability, it must inform the manufacturer without undue delay and, where there is a significant cybersecurity risk, also inform the relevant market surveillance authorities.
Article 19(3), Article 19(5)
The must keep a copy of the EU declaration of conformity at the disposal of market surveillance authorities for at least 10 years after placement on the market or for the support period, whichever is longer. It must also ensure that the technical documentation can be made available and must provide the necessary information and documentation further to a reasoned request.
Article 19(6)-(7)
Before making a product available on the market, the must verify that:
- the product bears the CE marking
- the and the complied with the documentation and traceability obligations listed in Article 20(2)
- the necessary documents have been provided to the
The must also act with due care in relation to the CRA's requirements.
Article 20(1)-(2)
If the considers or has reason to believe that the product or the 's processes are not in conformity, it must not make the product available until conformity is restored.
If the later knows or has reason to believe that a product it has made available is not in conformity, it must make sure that corrective measures, withdrawal or recall are taken as appropriate. Upon becoming aware of a vulnerability, it must inform the without undue delay and, where there is a significant cybersecurity risk, immediately inform the relevant market surveillance authorities.
Article 20(3)-(4)
Further to a reasoned request, the must provide the information and documentation necessary to demonstrate conformity and cooperate with the market surveillance authority on measures to eliminate cybersecurity risks.
If the becomes aware that the has ceased operations and can no longer comply with the CRA, it must inform the relevant market surveillance authorities without undue delay and, to the extent possible, also inform the users of the products placed on the market.
Article 20(5)-(6)
An or becomes the for CRA purposes if it:
- places the product on the market under its own name or trademark, or
- carries out a substantial modification of a product already placed on the market
In that case it becomes subject to Articles 13 and 14 as .
Article 21
section 3.1, section 3.3, section 3.4
A natural or legal person other than the , or that carries out a substantial modification and makes the product available on the market is also treated as the manufacturer.
That person becomes subject to the CRA obligations for the affected part of the product or, if the substantial modification affects the cybersecurity of the product as a whole, for the entire product.
Article 22
On request, economic operators must provide the market surveillance authorities with the name and address of the operator who supplied them with the product and, where available, the operator to whom they supplied it.
They must be able to present that information for 10 years after they were supplied with the product and for 10 years after they supplied it.
Article 23
Not as a named CRA operator category in Articles 18 to 23.
But the Commission FAQ explains that, for CRA-covered products, a established in the Union can act as the Article 4 responsible operator under Regulation (EU) 2019/1020 where there is no Union , or .
Article 3(12), Articles 18-23
section 4.6.1
No.
The CRA says that where an entity only provides online intermediation services for a given product and is merely a provider of an online marketplace, it does not qualify as one of the CRA economic operators for that product. But if the same entity also distributes that product, sells it under its own brand, or otherwise acts in an economic-operator role, it must comply with the obligations of that role.
recital 78
No.
The CRA says the sole act of hosting products with digital elements on open repositories, package managers or collaboration platforms does not by itself amount to making them available on the market. A provider of such a service is treated as a only if it actually makes the software available on the Union market in the course of a commercial activity.
recital 19
As a rule, they apply from 11 December 2027.
That is the CRA's general application date for the main economic-operator obligations in Chapter II. Earlier application dates in Article 71 concern other parts of the Regulation, such as notified bodies and reporting obligations, not the ordinary , and obligations as such.
Articles 18-23, Article 71(2)
Yes.
The CRA FAQ explains that a product with digital elements can be placed on the Union market only if there is an established in the Union performing the Article 4 tasks under Regulation (EU) 2019/1020. In direct third-country sales there may be no traditional in the usual commercial sense, but that does not remove the requirement. Depending on the setup, the role can be fulfilled by an or, if none exists, a established in the Union.
section 4.6.1
section 2.4 and section 3.6
No, not as a general CRA retention duty.
Under the CRA, the explicit long-term declaration-retention duty is imposed on manufacturers, authorised representatives within their mandate, and importers. Distributors must verify before making the product available that the required marking and documentation obligations have been met, and they must provide necessary information and documentation to authorities further to a reasoned request, but Article 20 does not impose the same express 10-year copy-retention duty on distributors that Article 19(6) imposes on importers.
Article 13(13), Article 18(3)(a), Article 19(6)-(7), Article 20(2) and Article 20(5)
section 3.4 and footnotes 143 and 149
No.
Importers and distributors have real due-care and verification duties, but the CRA does not turn them into second manufacturers by default. Importers must check that the has carried out the conformity assessment, drawn up the technical documentation, affixed the CE marking, and supplied the required declaration and Annex II information. Distributors must verify the marking and the listed documentation and traceability elements before making the product available. Those roles must react when they have reason to believe there is non-compliance, but they are not required by Articles 19 or 20 to repeat the manufacturer's risk assessment or conformity assessment from scratch.
Article 19(2)-(3), Article 20(1)-(3)
section 3.3, section 3.4 and footnote 143
Yes.
The Blue Guide explains that an of a third-country is no longer acting merely as an authorised representative if it supplies the product to a or directly to a consumer within the Union. In that case it becomes the and is subject to the importer's obligations.
No, unless they substantially modify them.
The Commission FAQ says products with digital elements placed on the market before 11 December 2027 are not subject to the CRA requirements, apart from the earlier reporting obligation timing rules, unless they are substantially modified. A is therefore not required to retrofit those pre-application products into CRA compliance merely because it continues making them available on or after 11 December 2027.
section 7.5
Article 69(2)-(3) preserves the general transition rule for products placed before 11 December 2027 while applying Article 14 reporting to earlier products; Article 71 sets the application dates.
Keep evidence by product and by operator role, not only in a generic CRA folder. The record should show who placed the product on the market, who made it available, whether a non-EU has an EU-established Article 4 operator, and whether any , or other person triggered manufacturer status by branding the product or substantially modifying it.
For the role, keep the EU declaration of conformity, technical documentation, conformity-assessment record, cybersecurity risk assessment, support-period statement, Annex II user information, vulnerability-handling process, and Article 14 reporting evidence. For an , keep the signed mandate, the declaration and technical-documentation custody record, authority-request log, and any task limits showing which Article 13 duties remain with the manufacturer.
For importers, keep the pre-placement check that the completed conformity assessment, technical documentation, CE marking, declaration, Annex II information and required contact details; keep the 's own contact details, manufacturer access assurance, declaration copy retention control, and escalation records for non-conformity, vulnerabilities or significant cybersecurity risk. For distributors, keep the due-care check before making the product available, evidence that required documents were supplied, traceability records for suppliers and recipients, and logs of corrective actions, withdrawal, recall, authority cooperation or manufacturer-cessation notices.
Articles 13-14 and 18-23
sections 3.1, 3.3, 3.4 and 7.2.3
section 4.6.1 and section 7.5
"all the information and documentation necessary to demonstrate the conformity"
"verify that the EU declaration of conformity and the technical documentation have been drawn up"
"Importers should have a written assurance from the manufacturer"