Importers and distributors: this is yours too

Your suppliers' problem becomes yours

If you bring connected devices or software into the EU, or pass them on to customers, the law gives you duties of your own. Lighter than the maker's, but yours. Most of them arrive with the rest of the law. One of them does not, and it is the one further down this page.

The main obligations of the Cyber Resilience Act (essential requirements, technical documentation, conformity assessment, CE marking, importer and distributor duties) apply from 11 December 2027.[Art. 71(2)] Importers and distributors check different things, and the distributor's list is the shorter of the two. Before placing a product on the market an importer must make sure the manufacturer carried out the right conformity assessment and drew up the technical documentation, that the product bears the CE marking and comes with the declaration of conformity and the user information, and that the manufacturer has put its identification and contact details on it and stated the end date of the support period. Before making a product available a distributor checks that it bears the CE marking, that the manufacturer and the importer have met their identification, contact-detail, user-information, support-period-end-date and declaration-of-conformity duties, and that all the necessary documents have been handed over. Neither may go ahead where it believes the product is not compliant.[Art. 19(1), 19(2), 19(3); Art. 20(1), 20(2), 20(3)]

In practice, from that date, the two roles are checked against different lists, and it is worth knowing which one you are in. If you bring a product into the EU from outside it, you have to be able to show that the maker did its job: that the assessment was carried out, that the technical paperwork exists, and that the signed declaration and the CE mark are there. If you only pass a product on to customers inside the EU, the list is shorter and more specific: the CE mark, and that the maker and the importer have done the things the buyer can see — their own names and contact details on the product, the information and instructions that come with it, and the date support ends. A product missing any of it should not go on the market.

Some duties are yours in your own right, and no supplier questionnaire will produce them for you. They are not the same for the two roles, and the heavier set is the importer's.

An importer and a distributor also carry duties in their own right, not only checks on the maker. An importer must put its own name, trade name or trademark and its contact address on the product, on its packaging or in a document accompanying it, in a language users and authorities can easily understand; and it must keep a copy of the EU declaration of conformity, and be able to produce the technical documentation on request, for at least ten years after the product was placed on the market or for the support period, whichever is longer. Both an importer and a distributor must answer a reasoned request from a market surveillance authority with the information and documentation needed to show conformity, and must tell the authorities — and, so far as they can, users — if the manufacturer ceases operations and can no longer meet its obligations.[Art. 19(4), 19(6), 19(7), 19(8); Art. 20(5), 20(6)]

If you are the importer, two of those are yours alone. Your name and an address where you can be reached go on the product, on its packaging, or in the paperwork that travels with it — that is artwork and tooling, so give it lead time. And you keep the declaration and stay able to produce the maker's technical file for an authority, long after the product went on sale.

If you only pass the product on inside the EU, neither of those is yours. The Act puts them on the importer, and your job is the shorter list above: check that the importer did them.

Both of you answer a reasoned request from a market surveillance authority when one arrives. And if you learn that the maker of a product you handle has ceased operations and can no longer meet its obligations, both of you tell the market surveillance authorities and, so far as you can, the users of that product. That is the duty that bites on the day a supplier goes under, which is exactly when a reseller most needs to know what it has to do.

And if you learn of a weakness in something you have already sold, "act" means two particular things rather than one general one: tell the maker, and — where the product carries a significant cybersecurity risk — tell the authorities in every country where you made it available.

An importer or a distributor that becomes aware of a vulnerability in a product it handles must tell the manufacturer about it without undue delay. And where the product presents a significant cybersecurity risk it must immediately tell the market surveillance authorities of every Member State in which it made that product available, giving details of the non-compliance and of any corrective measures taken. These are its own duties: they sit alongside the manufacturer's reporting duty to the CSIRT and ENISA and do not replace it.[Art. 19(5); Art. 20(4)]

There are two ways you stop being the reseller and become the maker, with the full set of duties:

An importer or a distributor that places a product on the market under its own name or trademark, or that substantially modifies a product already on the market — a change that affects whether it still meets the product security requirements, or that changes what the product was assessed to be for — is treated as the manufacturer and takes on the manufacturer's product obligations and reporting obligations in full. That deeming rule applies from 11 December 2027 with the rest of the Regulation: Article 71(2) brings forward only Article 14 and Chapter IV, and Article 21 is in neither. A reseller that markets a product under its own name or trademark does not need that rule to be reporting today: the definition of manufacturer covers having a product designed, developed or manufactured and marketing it under one's own name, and Recital 78 says that an entity selling its own branded products qualifies as a manufacturer — so the reporting duty reaches every own-name reseller from 11 September 2026, whether it had the product made for it or buys it in finished. What waits for 11 December 2027 is the substantial-modification limb, for an importer or distributor whose name is not on the product.[Art. 21; Art. 3(13); Art. 3(30); Art. 71(2); Recital 78]

Sell a supplier's product under your own name, and you are its maker in the eyes of this law. That is the one duty on this page that does not wait for the date above. Manufacturers' reporting obligations for actively exploited vulnerabilities and severe incidents apply from 11 September 2026.[Art. 71(2); Art. 14] If a weakness in that product is being exploited, or a serious incident hits its security, the clocks are yours — the own-brand guide covers what to get from your supplier. The first two filings are due without undue delay and in any event within the outer deadline — the hour figures are backstops, not an allowance to wait. For an actively exploited vulnerability: an early warning without undue delay and in any event within 24 hours of becoming aware, a vulnerability notification without undue delay and in any event within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure is available.[Art. 14(2)]

For a severe incident the first two filings carry the same two-part standard: an early warning without undue delay and in any event within 24 hours of becoming aware, and an incident notification without undue delay and in any event within 72 hours. The final report is due within one month after the incident notification is submitted — the month runs from the filing, not from the 72-hour deadline.[Art. 14(4)]

Or change the product after it is on the market — in a way that affects how secure it is, or that changes what it is for compared with what it was assessed for — and then supply it on. Do that and you are treated as the maker of that product, with the maker's full set of product and reporting duties. There is a narrower version of this rule that stops at the part of the product you changed, and it is easy to assume it is the one that applies to you. It is not: that one is written for someone who is neither the maker, the importer nor the distributor. An importer or a distributor that modifies a product takes the whole role.

What we do here is advisory and it is deliberately narrow. We give you the questions to ask, read what comes back and tell you what it means. Deciding which products you keep selling, and what you say to a supplier who cannot answer, stays with you — as does the duty itself. We do not give legal advice and we cannot check a product on your behalf.