Your name on someone else's product: what the Cyber Resilience Act asks

If a product goes out under your name or your trademark, the Cyber Resilience Act treats you as the company that made it — even if a supplier designed it, built it and wrote every line of its software. That is true of a white-label product ordered to your specification and of a finished one you buy in and badge. Here is what that means, why the reporting duty is already yours, and what to get from the supplier who actually made it.

Your name makes you the manufacturer

The manufacturer is the person or company that develops or makes a product with digital elements, or has it designed, developed or made by someone else, and sells it under its own name or trademark — whether for payment, for monetisation or free of charge. Outsourcing the build does not move you out of the definition, and neither does giving the product away.[Art. 3(13)]

The Act's own recital on online sellers says the same thing in plainer words. The Regulation's recital on online sales says that an entity that sells its own branded products with digital elements would qualify as a manufacturer and would have to comply with the requirements that apply to manufacturers. A recital records the legislator's stated intent and is not itself binding; the binding rule is the definition of manufacturer, which covers having a product designed, developed or manufactured and marketing it under one's own name or trademark.[Recital 78; read with Art. 3(13), which is the operative provision]

So the duties are yours, not your supplier's, and for the whole product rather than the part you had a hand in: the product security requirements, the technical documentation, the conformity assessment, the CE marking, the support period — and reporting.

The reporting duty is already yours

Manufacturers' reporting obligations for actively exploited vulnerabilities and severe incidents apply from 11 September 2026.[Art. 71(2); Art. 14] There is a separate rule that makes an importer or a distributor the manufacturer when it puts its own name on a product, and it applies later with the rest of the Act. You do not need it to be caught now. An importer or a distributor that places a product on the market under its own name or trademark, or that substantially modifies a product already on the market — a change that affects whether it still meets the product security requirements, or that changes what the product was assessed to be for — is treated as the manufacturer and takes on the manufacturer's product obligations and reporting obligations in full. That deeming rule applies from 11 December 2027 with the rest of the Regulation: Article 71(2) brings forward only Article 14 and Chapter IV, and Article 21 is in neither. A reseller that markets a product under its own name or trademark does not need that rule to be reporting today: the definition of manufacturer covers having a product designed, developed or manufactured and marketing it under one's own name, and Recital 78 says that an entity selling its own branded products qualifies as a manufacturer — so the reporting duty reaches every own-name reseller from 11 September 2026, whether it had the product made for it or buys it in finished. What waits for 11 December 2027 is the substantial-modification limb, for an importer or distributor whose name is not on the product.[Art. 21; Art. 3(13); Art. 3(30); Art. 71(2); Recital 78]

In practice: if a vulnerability in your branded product is being exploited, the clock that starts is yours, even if the only people who can fix the code work for your supplier. The reporting guide covers what to have in place.

If you change the product

Changing a product after it is on the market can make you its manufacturer even without your name on it. A substantial modification is a change to a product after it has been placed on the market that either affects whether the product still meets the product security requirements in Annex I Part I, or changes the intended purpose the product was assessed for. A person other than the manufacturer, the importer or the distributor who makes such a change and then makes the product available on the market is treated as the manufacturer. Making available is wider than placing on the market: supplying a product that is already on the market counts, so a systems integrator that reworks someone else's product and passes it on is caught. The obligations that person takes on are the manufacturer's product and reporting obligations for the part of the product the change affects, or for the whole product where the change affects its cybersecurity as a whole. Importers and distributors are reached by their own, separate rule, and that one carries no such limit: an importer or a distributor that places a product on the market under its own name or substantially modifies one already on the market is subject to Articles 13 and 14 for the product, not only for the part it changed. One kind of change is expressly outside the concept, and the statement of it sits in the recitals rather than in the enacting terms: a security update designed to decrease the product's cybersecurity risk, which does not modify the intended purpose, is not a substantial modification, and a minor functionality update such as a visual change or a new interface language generally is not either. A feature update that changes the original intended functions, or the type or performance of the product, is.[Art. 3(30); Art. 22(1), 22(2); Art. 21; Recital 39 for the security-update carve-out, which is intent rather than an operative provision]

What to get from your supplier

You carry the duties; your supplier holds most of what you need to meet them. Your supply contract is where the two meet, and it should give you:

• A component list for every release you sell, generated from the build and delivered with the release.
• A vulnerability contact and a notification promise: the supplier tells you about any weakness in your product fast enough for you to meet your own reporting clock.
• Security fixes for your whole support period, delivered separately from feature releases, with notes on what each one fixes.
• Access to the technical documentation and test evidence you will need for the file and the conformity assessment, or to a supplier who will produce it with you.
• A plan for the day the supplier stops: what happens to the code, the build and the fixes if they cease trading or end the product.

If you only resell under the maker's name

Then you are not the manufacturer; you are an importer or a distributor, with a different and shorter list of duties. An importer is a person established in the Union who places on the market a product with digital elements that bears the name or trademark of a natural or legal person established outside the Union. A distributor is anyone else in the supply chain, other than the manufacturer or the importer, that makes a product available on the Union market without affecting its properties. Which of the two a company is turns on where the maker is established and on whether the company changes the product.[Art. 3(16); Art. 3(17)] The importers and distributors page covers what is yours, and gives you a checklist to send to every supplier.

The checklist

• You have listed every product that carries your name or trademark.
• For each one, you can produce a component list for every release you sell.
• Your supplier must tell you about a vulnerability fast enough for your own reporting clock, and that is written into the contract.
• Security fixes are contracted for the whole support period you print.
• You can reach the technical documentation, or the people who can build it with you.
• You know what happens if the supplier stops.

If you want help

Our scope check asks what your company does with the product — makes it, badges it, changes it or resells it — and tells you, free and in about two minutes, whether the Act applies and which duties are yours, with the article behind each answer. It is our engineering reading of the law, not a legal ruling.