How the CRA Reshapes Digital Supply Chains

The CRA doesn't just regulate manufacturers. It creates obligations for every entity in the product supply chain — importers, distributors, and even authorized representatives.

Manufacturer Obligations

The primary duty holder. Must ensure products meet essential requirements, perform conformity assessment, maintain technical documentation, provide security updates, and report vulnerabilities.

Importer Obligations

Before placing a product on the EU market, importers must:

• Verify the manufacturer has performed conformity assessment
• Ensure the product bears CE marking and required documentation
• Check that the manufacturer has provided contact information on the product
• Maintain a copy of the EU Declaration of Conformity for 10 years
• Report known non-compliance to market surveillance authorities

Distributor Obligations

Distributors must verify that the product bears CE marking and that the manufacturer and importer have complied with their obligations. If a distributor modifies the product or markets it under their own name, they become the manufacturer.

Procurement Impact

Expect EU procurement departments to add CRA compliance to their vendor questionnaires. Non-EU manufacturers selling into the EU will need authorized representatives. Due diligence on digital component suppliers becomes a legal requirement, not a best practice.