Importers and resellers
If you import or resell, this is yours too
Importers and distributors get duties of their own on the same date. A checklist to send every supplier, and a way to send a stuck supplier to us.
Updated 7 September 2026
Your suppliers' problem becomes yours
If you bring connected devices or software into the EU, or pass them on to customers, the law gives you duties of your own. Lighter than the maker's, but yours — and they start on the same day.
The main obligations of the Cyber Resilience Act (essential requirements, technical documentation, conformity assessment, CE marking, importer and distributor duties) apply from 11 December 2027.[Art. 71(2)] Importers may place only compliant products on the market and must verify that the manufacturer has carried out conformity assessment, drawn up the technical documentation and affixed the CE marking; distributors must verify the CE marking, the declaration of conformity and that the manufacturer and importer have met their duties.[Arts. 19, 20]In practice, from that date you need to be able to show, for every product you sell, that the maker did its job: the checks, the paperwork, the signed declaration, the CE mark and an address where security problems can be reported. A product without them should not go on the market. And if you learn that something you have already sold is affected, you have to act.
There are two ways you stop being the reseller and become the maker, with the full set of duties:
An importer or distributor that markets a product under its own name or trademark, or substantially modifies it, is treated as the manufacturer.[Art. 21]Sell a supplier's product under your own name, or change it in a way that affects its security, and you should plan as the maker.
What we do here is advisory and it is deliberately narrow. We give you the questions to ask, read what comes back and tell you what it means. Deciding which products you keep selling, and what you say to a supplier who cannot answer, stays with you — as does the duty itself. We do not give legal advice and we cannot check a product on your behalf.
Ask every supplier these eight questions
Most of your exposure sits upstream. A supplier who cannot produce the evidence in time blocks your sales, and a supplier outside the EU may not have started at all. The duty follows the product into the EU market wherever the maker sits, which is exactly the thing that is easy to miss from outside Europe.
The Regulation applies to products with digital elements made available on the Union market in the course of a commercial activity, whatever the size or place of establishment of the manufacturer.[Art. 2(1); Art. 3]Our checklist asks for the eight things that reveal readiness fastest: a draft declaration, confirmation that the paperwork exists, the list of components in the current release, how long the product is supported, where security problems get reported, how updates reach the product, who tells you when one of your products is affected, and the plan for the CE mark.
It is two pages, written so a procurement or quality manager can send it as it stands — no compliance function, no project, and nothing to install. Suppliers who answer quickly are ready. Suppliers who ask what a component list is are the ones to worry about.
Take it and use it without us. It is free, it is yours, and it works whether or not you ever talk to us.
Send us a supplier who is stuck
If a supplier comes back with gaps, hand them to us. Tell us their company name, website and country, and what they supply you. Any country: we approach a maker in Taipei the same way as one in Turin, in English.
We contact the supplier's general or security mailbox within two working days, say that you referred them, and offer the free check and a call. Nothing else is sent, ever.
If they book a call, we scope the product with them and propose the work that closes the gaps you found, starting with what is on your checklist.
With their agreement, we tell you where they stand against the list, so you can plan. Without it, we tell you only that we made contact.
Referral terms are agreed in writing before the first referral. [REFERRAL TERMS TO CONFIRM]
The form asks for your name, company and email, and the supplier's details. We keep it for this purpose only. See the privacy notice.
Talk to us about your supplier list
Tell us who supplies you, and what came back when you asked them.