Art. 3(17)An importer is any natural or legal person established in the Union who places on the market a product with digital elements that bears the name or trademark of a natural or legal person established outside the Union.
11 December 2024 — CRA enters into force
The regulation is legally in effect. Products placed on the market from this date must comply with CRA once the application dates are reached.
11 September 2026 — Vulnerability reporting obligations apply
Article 14 vulnerability and incident reporting to ENISA becomes mandatory. This is the first hard deadline. Manufacturers must have their reporting processes in place before this date.
11 June 2027 — Conformity assessment body notification
Member States must notify conformity assessment bodies to the Commission.
11 December 2027 — Full regulation applies
All CRA requirements apply to all in-scope products. No new products may be placed on the EU market that do not conform.
Before placing a product with digital elements on the EU market, importers must verify that the manufacturer has carried out the appropriate conformity assessment, drawn up technical documentation, affixed the CE marking, and made the EU declaration of conformity or declaration of performance available.
Where an importer considers or has reason to believe that a product with digital elements is not in conformity with the essential cybersecurity requirements, the importer must not place the product on the market until conformity is achieved.
Importers must indicate their name, registered trade name or trademark, postal address, and where available their website or email address, on the product itself, on its packaging, or in a document accompanying the product.
While a product with digital elements is under the importer's responsibility, the importer must ensure that storage and transport conditions do not jeopardise its conformity with the essential cybersecurity requirements.
If an importer learns that a product they have placed on the market is not in conformity, they must immediately take corrective action — including withdrawal or recall if necessary. Where the product poses a significant cybersecurity risk, the importer must immediately notify the relevant national competent authority.
Importers must keep a copy of the EU declaration of conformity or declaration of performance for 10 years after the product is placed on the market, and ensure that technical documentation can be made available to market surveillance authorities upon request.
Upon a reasoned request from a competent authority, importers must provide all information and documentation — in paper or electronic form — necessary to demonstrate the conformity of a product with digital elements. They must also cooperate on any corrective action required.
An importer or distributor is treated as a manufacturer — and is subject to all of Articles 13 and 14 — if they place a product with digital elements on the market under their own name or trademark, or if they carry out a substantial modification of an already-placed product.
Any natural or legal person — other than the original manufacturer, importer, or distributor — who carries out a substantial modification of a product and then makes it available on the market is treated as the manufacturer. That person is then subject to Articles 13 and 14 either for the affected part of the product or, if the modification affects the entire product's cybersecurity, for the whole product.
All economic operators must be able to identify, on request from market surveillance authorities, (a) any economic operator who supplied them with a product, and (b) any economic operator to whom they supplied a product. Records must be maintainable for 10 years from each transaction.
Explore the full obligations library, understand your role, or view the regulatory timeline.