FAQ item index

Search every question across sub-FAQs

Find the exact question, open the source answer card, and copy a direct link to the anchored sub-FAQ response.

Indexed coverage
826of826items
Across 40 modules • Updated Mar 10, 2026
Author
Sorena AI
Published
Mar 10, 2026
Updated
Mar 10, 2026
CRA Declaration of Conformity

Do importers and distributors have declaration-related duties?

Yes. Before placing a product on the market, importers must check that the manufacturer has carried out the appropriate conformity assessment, drawn up technical documentation, applied CE marking, and supplied the declaration required by Article 13(20). Importers must keep a copy of the EU Declaration of Conformity for at least 10 years after placement on the market or for the support period, whichever is longer.

Distributors must act with due care and, before making the product available, verify that the product bears the CE marking and that the manufacturer and importer have complied with the relevant documentation and accompanying-information obligations.

Citations
Cyber Resilience Act

Article 19(2), Article 19(6), and Article 20(2) set importer and distributor checks related to the declaration.

CRA Declaration of Conformity

If several EU product laws apply, can one declaration cover all of them?

Yes. Where the product is subject to more than one Union legal act requiring an EU Declaration of Conformity, the CRA requires a single EU Declaration of Conformity covering all those acts and identifying them, including their publication references.

The Blue Guide and Commission FAQ explain that this single declaration can be organised as a dossier made up of the relevant individual declarations. That helps when one applicable Union act changes, but the public declaration package still needs to clearly identify every act it covers.

Citations
Cyber Resilience Act

Article 28(3) and recital 88 require a single declaration where several Union acts require one.

CRA Declaration of Conformity

Does the declaration need a unique identifier for each individual unit?

Not necessarily. The declaration must identify the product sufficiently for traceability, and Annex V refers to the product name, type, and other identifying information. The Commission FAQ explains that the declaration is linked to the individual product, but it does not need to include each unit's unique identifier.

In practice, the same declaration version may cover many products manufactured in series if it still accurately identifies the covered product model or version and the conformity basis has not changed.

Citations
CRA Declaration of Conformity

When does the Declaration of Conformity need to be updated?

The CRA says the declaration must be updated as appropriate. The Blue Guide gives practical examples: a change in applicable legislation, a change in the versions of harmonised standards, or a change in the manufacturer or authorised representative contact details can require an update for products placed on the market after that change.

CRA teams should also review the declaration when a product version changes, when a substantial modification creates a new conformity situation, when the chosen conformity assessment basis changes, when a certificate reference changes, or when the technical documentation is updated in a way that affects the declared compliance basis.

Citations
Cyber Resilience Act

Article 28(2) requires the declaration to be updated as appropriate; Article 13(14) requires series-production conformity procedures to account for relevant changes.

CRA Declaration of Conformity

How long must the CRA Declaration of Conformity be kept?

Manufacturers must keep the technical documentation and EU Declaration of Conformity available to market surveillance authorities for at least 10 years after the product has been placed on the market or for the support period, whichever is longer.

The same retention period appears for authorised representatives where their mandate covers keeping the declaration and technical documentation, and for importers keeping a copy of the declaration. This means the declaration archive should be tied to product placement records and support-period records, not just to the initial release date.

Citations
Cyber Resilience Act

Article 13(13), Article 18(3)(a), and Article 19(6) set retention duties for manufacturers, authorised representatives, and importers.

CRA Declaration of Conformity

Does citing a harmonised standard in the declaration create presumption of conformity by itself?

No. The declaration records the conformity basis; it does not create presumption of conformity by merely naming a standard. Under the CRA, presumption of conformity depends on the relevant Article 27 route, such as correctly applying harmonised standards whose references have been published in the Official Journal, applicable common specifications, or qualifying European cybersecurity certification schemes.

The Blue Guide is explicit that referencing a harmonised standard in the declaration without applying that standard, or the relevant parts of it, does not start presumption of conformity. If only part of a standard is applied, the technical documentation should show what was applied and how the remaining applicable CRA requirements were met.

Citations
Cyber Resilience Act

Article 27 defines CRA presumption-of-conformity routes; Annex V point 6 requires references to the relevant standards, specifications, or certifications used.

CRA Declaration of Conformity

What evidence controls should support a CRA declaration?

A useful declaration control set links each declaration version to the product model or software version covered, the conformity assessment route, the technical documentation version, the cybersecurity risk assessment, the support-period rationale, the list of standards or other specifications applied, test reports, notified-body certificates where applicable, and the public or customer-facing URL used for the simplified declaration.

Keep an approval record showing who signed the declaration and why the evidence was sufficient. When a release, standard, certificate, manufacturer address, or conformity route changes, review whether the declaration and simplified-declaration URL need a new version. This is evidence discipline, not a separate CRA legal form, but it is the practical way to show that the signed declaration matches the technical file and the product being supplied.

Citations
Cyber Resilience Act

Annex VII identifies the evidence that should sit behind the declaration, including standards, test reports, cybersecurity risk assessment, and the declaration copy.

CRA Declaration of Conformity

What happens if the Declaration of Conformity is missing or incorrect?

Under the CRA, a missing EU Declaration of Conformity or an incorrectly drawn-up declaration is formal non-compliance. The market surveillance authority must require the relevant manufacturer to end the non-compliance.

If the formal non-compliance persists, the Member State must take appropriate measures to restrict or prohibit the product from being made available on the market, or ensure that it is recalled or withdrawn. Article 58 also treats missing or incomplete technical documentation and CE-marking failures as formal non-compliance.

Citations
Cyber Resilience Act

Article 58 identifies missing or incorrectly drawn-up declarations as formal non-compliance and describes authority follow-up.

CRA Economic Operators

What is an economic operator under the CRA?

Under the CRA, an economic operator means the manufacturer, authorised representative, importer, distributor, or another natural or legal person that is subject to obligations relating to the manufacture of products with digital elements or to their making available on the market under the Regulation.

Citations
CRA Economic Operators

How does the CRA distinguish manufacturers, authorised representatives, importers and distributors?

The CRA defines them as separate roles:

- the manufacturer develops, manufactures, or has the product designed, developed or manufactured, and markets it under its own name or trademark

- the authorised representative is an EU-established person with a written mandate from the manufacturer to act on specified tasks

- the importer is an EU-established person who places on the market a product bearing the name or trademark of a person established outside the Union

- the distributor is a person in the supply chain, other than the manufacturer or importer, who makes the product available on the Union market without affecting its properties

Citations
CRA Economic Operators

Can the same company have different CRA roles for different products or sales channels?

Yes.

The CRA recognises that the same business can perform different functions depending on the product and the service it provides. A business that only provides online intermediation for one product may not be a CRA economic operator for that product, while the same business could still be a distributor or a manufacturer for other products that it actually sells or brands.

Citations
CRA Economic Operators

If a company sells a product under its own brand, is it the manufacturer even if someone else designed or built it?

Yes.

Under the CRA definition, what matters is not only who physically developed or assembled the product, but also who markets it under its own name or trademark. If a business places the product on the market under its own brand, it takes the manufacturer role for CRA purposes.

CRA Economic Operators

Is an authorised representative mandatory under the CRA?

Not in every case.

Article 18 says a manufacturer may appoint an authorised representative by written mandate, so the appointment is optional under the CRA itself. But where the manufacturer is established outside the Union, a CRA-covered product can only be placed on the Union market if there is an EU-established operator performing the tasks required by Article 4 of Regulation (EU) 2019/1020.

Citations
CRA Economic Operators

Can a third-country manufacturer place CRA products on the Union market without any EU-based operator?

No.

The Commission FAQ explains that a non-EU manufacturer needs an economic operator established in the Union to perform the Article 4 tasks under Regulation (EU) 2019/1020. Depending on the setup, that can be an importer, an authorised representative or, where no other such operator exists, a fulfilment service provider.

Citations
CRA Economic Operators

What can an authorised representative do under the CRA?

The authorised representative performs the tasks specified in the written mandate from the manufacturer. At minimum, that mandate must allow it to:

- keep the EU declaration of conformity and technical documentation at the disposal of market surveillance authorities

- provide the relevant information and documentation to market surveillance authorities on request

The authorised representative must also provide a copy of its mandate to market surveillance authorities on request.

Citations
CRA Economic Operators

What can an authorised representative not take over from the manufacturer?

The authorised representative cannot take over the manufacturer's core product-compliance obligations listed in Article 13(1) to (11), Article 13(12), first subparagraph, and Article 13(14).

That means the authorised representative can help with documentation and authority-facing tasks, but it does not supersede the manufacturer for the core design, risk assessment, conformity assessment and ongoing compliance duties that the CRA keeps with the manufacturer.

Citations
CRA Economic Operators

What are the importer's key CRA checks before placing a product on the market?

Before placing a product on the market, the importer must ensure that:

- the manufacturer carried out the appropriate conformity assessment

- the manufacturer drew up the technical documentation

- the product bears the CE marking and is accompanied by the declaration of conformity and Annex II information and instructions in an understandable language

- the manufacturer complied with the identification, contact-detail and support-period-end-date obligations in Article 13(15), (16) and (19)

Citations
CRA Economic Operators

What must an importer do under the CRA if it doubts compliance or learns of a vulnerability?

If the importer considers or has reason to believe that the product or the manufacturer's processes are not in conformity, it must not place the product on the market until conformity is restored.

If the product presents a significant cybersecurity risk, the importer must inform the manufacturer and the market surveillance authorities. After placement on the market, if the importer becomes aware of a vulnerability, it must inform the manufacturer without undue delay and, where there is a significant cybersecurity risk, also inform the relevant market surveillance authorities.

Citations
CRA Economic Operators

What must an importer keep and provide to authorities under the CRA?

The importer must keep a copy of the EU declaration of conformity at the disposal of market surveillance authorities for at least 10 years after placement on the market or for the support period, whichever is longer. It must also ensure that the technical documentation can be made available and must provide the necessary information and documentation further to a reasoned request.

Citations
CRA Economic Operators

What are the distributor's key CRA checks before making a product available on the market?

Before making a product available on the market, the distributor must verify that:

- the product bears the CE marking

- the manufacturer and the importer complied with the documentation and traceability obligations listed in Article 20(2)

- the necessary documents have been provided to the distributor

The distributor must also act with due care in relation to the CRA's requirements.

Citations
Page 6 of 42