CRA guide for importers, distributors & resellers
What economic operators must verify before; and after; making a product with digital elements available on the EU market.
Compliance steps
Verify the product is compliant
Art. 19 · 23Before placing a product on the market, confirm the manufacturer has met their obligations.
- ✓Check the CE marking is affixed
- ✓Confirm the EU declaration of conformity exists
- ✓Ensure user information and instructions are included
Confirm documentation and support
Art. 23(2)Make sure the manufacturer's technical documentation and support arrangements are in place.
- ✓Verify a support period is declared
- ✓Confirm a vulnerability-reporting contact exists
- ✓Keep a copy of the declaration of conformity
You must not place a product on the market if you have reason to believe it does not conform.
Exercise due diligence (distributors)
Art. 26Distributors must act with due care in relation to the requirements.
- ✓Check the CE marking and accompanying documents
- ✓Ensure storage and transport do not compromise conformity
- ✓Act if you suspect non-conformity
Cooperate and report
Art. 23(5)Inform manufacturers and authorities of risks, and support corrective action.
- ✓Notify the manufacturer of identified risks
- ✓Inform market surveillance authorities where required
- ✓Assist with recalls or corrective measures
Keep records
Art. 23(7)Maintain the records that let authorities trace the product through the supply chain.
- ✓Identify the economic operators you supplied or were supplied by
- ✓Retain records for ten years
- ✓Make them available to authorities on request
Every tool below is free to use and opens here in a side panel, so you don't lose your place.
Confirm whether the Act applies and your likely class.
Open here →FreeCompliance matrixMap every Annex I & VII obligation and track it to done.
Open here →FreeCost calculatorEstimate the one-off and annual cost of compliance.
Open here →FreeVulnerability AnalyzerCross-reference your SBOM against the NVD & EUVD, and track End-of-Life components.
Open here →FreeDoC generatorGenerate an EU Declaration of Conformity (Annex V) for your product.
Open here →FreeClassification finderPin down whether your product is default, important or critical, by name.
Open here →FreeSupport-period plannerSet your minimum support period and flag components that reach End-of-Life too soon.
Open here →Other stakeholder guides
Software developers
How the Cyber Resilience Act applies to software products; from secure development to vulnerability handling, SBOMs and the CE marking.
Manufacturers
The obligations the Cyber Resilience Act places on producers of products with digital elements; from risk assessment to CE marking and post-market duties.
How to obtain a CE marking
The steps to declare conformity and affix the CE marking for a product with digital elements.