IN SHORT
The manufacturer carries the core obligations: design to Annex I, risk assessment, vulnerability handling for the support period, technical documentation, conformity assessment, CE marking and reporting under Article 14. Importers and distributors must check that those steps have been done before supplying the product, must not supply non-conforming products, and must pass on information about vulnerabilities and risks. An importer or distributor that sells a product under its own name or trademark, or anyone who substantially modifies a product and makes it available, is treated as a manufacturer. An authorised representative acts under a written mandate but cannot take over the manufacturer’s design and documentation duties. Open-source software stewards have a light-touch regime.
Who is an “economic operator”?
The Regulation defines economic operators as the manufacturer, the authorised representative, the importer, the distributor, or any other natural or legal person subject to obligations relating to the manufacture or making available of products with digital elements (Article 3, point (12)).
| Role | Definition in short | Provision |
|---|---|---|
| Manufacturer | Develops or manufactures products (or has them designed, developed or manufactured) and markets them under its name or trademark, whether for payment, monetisation or free of charge | Article 3, point (13) |
| Authorised representative | Established in the Union, with a written mandate from a manufacturer to act on its behalf for specified tasks | Article 3, point (15) |
| Importer | Established in the Union, places on the market a product bearing the name or trademark of a person established outside the Union | Article 3, point (16) |
| Distributor | Other than the manufacturer or importer, makes a product available on the Union market without affecting its properties | Article 3, point (17) |
| Open-source software steward | A legal person, not a manufacturer, that systematically supports on a sustained basis the development of specific free and open-source products intended for commercial activities | Article 3, point (14) |
Manufacturers
What the text requires
Manufacturers must, among other things (Article 13):
- ensure the product is designed, developed and produced in accordance with Part I of Annex I (Article 13(1)), on the basis of a documented cybersecurity risk assessment (Article 13(2), Article 13(3));
- exercise due diligence on third-party components, including open-source components (Article 13(5));
- handle vulnerabilities effectively for the support period, in accordance with Part II of Annex I (Article 13(8), first subparagraph);
- draw up the technical documentation, carry out the conformity assessment, draw up the EU declaration of conformity and affix the CE marking (Article 13(12));
- keep the documentation for at least 10 years or the support period, whichever is longer (Article 13(13));
- identify the product and give contact details and a single point of contact for users (Article 13(15), Article 13(16), Article 13(17));
- provide the user information of Annex II and specify the end date of the support period (Article 13(18), Article 13(19));
- take corrective measures, withdraw or recall when they know or have reason to believe the product is not in conformity (Article 13(21));
- notify actively exploited vulnerabilities and severe incidents (Article 14).
Details are in our guides on the essential requirements and vulnerability management.
Authorised representatives
What the text requires
A manufacturer may appoint an authorised representative by written mandate (Article 18(1)). The mandate cannot include the obligations of Article 13(1) to (11), the drawing up of technical documentation (Article 13(12), first subparagraph) or Article 13(14) (Article 18(2)). It must at least allow the representative to keep the EU declaration of conformity and the technical documentation available to authorities, provide information and documentation on reasoned request, and cooperate with authorities (Article 18(3)).
Importers
What the text requires
Importers may place on the market only products that comply with Part I of Annex I and whose manufacturer’s processes comply with Part II (Article 19(1)). Before placing a product on the market they must ensure that the conformity assessment was carried out, the technical documentation exists, the product bears the CE marking and is accompanied by the EU declaration of conformity and Annex II information, and that the manufacturer has met the identification and support-period information requirements (Article 19(2), first subparagraph). They must be able to provide the documents proving this (Article 19(2), second subparagraph).
Importers must also: not place a product on the market while they have reason to believe it is not in conformity, and inform the manufacturer and authorities of significant cybersecurity risks (Article 19(3)); indicate their own contact details (Article 19(4)); inform the manufacturer of vulnerabilities without undue delay and take or ensure corrective measures (Article 19(5)); keep the declaration of conformity available for 10 years or the support period, whichever is longer (Article 19(6)); and inform authorities and users if the manufacturer ceases its operations (Article 19(8)).
Distributors
What the text requires
Distributors must act with due care (Article 20(1)). Before making a product available they must verify that it bears the CE marking and that the manufacturer and the importer have complied with the specified identification, information and documentation obligations (Article 20(2)). They must not make available a product they consider not to be in conformity, and must inform the manufacturer of vulnerabilities and authorities of significant risks (Article 20(3), Article 20(4)).
When an importer, distributor or other person becomes the manufacturer
What the text requires
An importer or distributor is considered a manufacturer, subject to Articles 13 and 14, where it places a product on the market under its own name or trademark or carries out a substantial modification of a product already placed on the market (Article 21). Any other person who substantially modifies a product and makes it available on the market is also considered a manufacturer — for the part affected by the modification or, if the modification affects the cybersecurity of the whole product, for the entire product (Article 22(1), Article 22(2)).
Our interpretation
“Substantial modification” is defined by reference to compliance with Part I of Annex I and to the intended purpose for which the product was assessed (Article 3, point (30)). The recitals indicate that a security update which only decreases risk without changing the intended purpose is not a substantial modification (Recital 39). White-labelling a product under your own brand, by contrast, makes you the manufacturer under Article 21 whatever the technical changes.
Identifying the supply chain
Every economic operator must, on request, tell market surveillance authorities who supplied them and, where available, to whom they supplied the product, and be able to do so for 10 years (Article 23(1), Article 23(2)).
Open-source software stewards
What the text requires
Open-source software stewards must put in place and document in a verifiable manner a cybersecurity policy fostering secure development and effective vulnerability handling, cooperate with market surveillance authorities and provide that documentation on reasoned request (Article 24(1), Article 24(2)). Reporting of actively exploited vulnerabilities applies to them to the extent they are involved in development, and incident reporting to the extent incidents affect the systems they provide for development (Article 24(3)).
The administrative fines of Article 64(2) to (9) do not apply to infringements by open-source software stewards (Article 64(10), point (b)). See our open-source guide.
Summary table
| Obligation | Manufacturer | Importer | Distributor | Authorised representative |
|---|---|---|---|---|
| Design to Annex I, risk assessment, vulnerability handling | Yes | Checks before placing | Due care | Not delegable |
| Technical documentation | Draws it up | Ensures it exists; makes it available on request | — | Keeps it available if mandated |
| Conformity assessment, declaration, CE marking | Performs or has performed | Ensures performed; checks CE marking | Checks CE marking | — |
| Article 14 reporting | Yes | — (informs manufacturer of vulnerabilities) | — (informs manufacturer of vulnerabilities) | — |
| Corrective measures, withdrawal, recall | Yes | Yes | Ensures they are taken | Cooperates if mandated |
| Contact details on product | Yes | Adds its own | Verifies | — |
Fictional example — Lumen Trading
Lumen Trading (fictional), based in the EU, imports smart plugs made by a manufacturer outside the Union and sells them under the manufacturer’s brand. As importer, Lumen checks the CE marking, the EU declaration of conformity, the Annex II information and the support-period end date before placing each batch on the market, keeps the documents, and forwards any vulnerability reported by customers to the manufacturer. If Lumen started selling the same plugs under its own “Lumen Home” brand, it would become the manufacturer under Article 21 and take on Articles 13 and 14 in full.
Uncertain / awaiting guidance
The text does not list every situation in which a business that customises or integrates products becomes a manufacturer, for example for software configured for a specific client. The assessment turns on the definitions of manufacturer and substantial modification; document your analysis and watch for guidance from the Commission.
Good practice (recommendation, not a legal requirement)
Map your role for each product and each market channel: you can be a manufacturer for some products and a distributor or importer for others. Put the checks of Articles 19 and 20 into your purchasing and listing procedures, and agree in your contracts how vulnerability information flows between you and your suppliers.