Cyber Resilience Act III: importers, distributors, open source and contracts

The legal framework

The Cyber Resilience Act, Regulation (EU) 2024/2847, puts most of the burden on the manufacturer. But it gives roles to everyone in the supply chain, and its rules on open source decide whether a free project or the company that uses it carries the load. The duties in this article apply from 11 December 2027 (Article 71). Contracts signed today will still run then.

Part I explains which products are caught. Part II covers reporting since 11 September 2026.

The roles

Article 3 defines:

• manufacturer: a person who develops or manufactures products with digital elements, or has them designed, developed or manufactured, and markets them under its own name or trademark, "whether for payment, monetisation or free of charge" (point 13);
• authorised representative: a person established in the Union with a written mandate from a manufacturer (point 15);
• importer: a person established in the Union who places on the market a product bearing the name or trademark of a person established outside the Union (point 16);
• distributor: any other person in the supply chain who makes a product available on the Union market without affecting its properties (point 17);
• open-source software steward: a legal person, other than a manufacturer, that systematically provides sustained support for the development of specific free and open-source products intended for commercial activities, and ensures their viability (point 14).

Authorised representatives (Article 18)

A manufacturer may appoint an authorised representative by written mandate (Article 18). The design duties of Article 13(1) to (11), drawing up the technical documentation and keeping series production in conformity cannot be delegated. The mandate must at least allow the representative to keep the declaration of conformity and technical documentation available for at least ten years or the support period, if longer, to provide information to authorities on request, and to cooperate with them.

Importers (Article 19)

Importers may place on the market only products that meet Part I of Annex I, made by a manufacturer whose processes meet Part II (Article 19(1)). Before placing a product on the market, the importer ensures that (Article 19(2)):

• the manufacturer has carried out the right conformity assessment and drawn up the technical documentation;
• the product bears the CE marking and comes with the EU declaration of conformity and the user information of Annex II, in a language users and authorities easily understand;
• the manufacturer has met the identification, contact details and support-period requirements of Article 13(15), (16) and (19).

The importer must be able to show the documents proving this. Further duties:

• not place a product on the market if it has reason to believe it does not conform, and inform the manufacturer and the market surveillance authorities if there is a significant cybersecurity risk (Article 19(3));
• put its own name and contact details on the product, its packaging or an accompanying document (Article 19(4));
• take corrective action, withdraw or recall where needed, and tell the manufacturer about any vulnerability without undue delay (Article 19(5));
• keep the declaration of conformity for at least ten years or the support period, if longer, and make sure the technical documentation can be produced (Article 19(6));
• inform authorities and, where possible, users if the manufacturer ceases its operations (Article 19(8)).

Distributors (Article 20)

Distributors must "act with due care" (Article 20(1)). Before making a product available, they verify that it bears the CE marking and that the manufacturer and importer have complied with Article 13(15), (16), (18), (19) and (20) and Article 19(4), and have given them all necessary documents (Article 20(2)). Like importers, they hold back non-conforming products, inform the manufacturer about vulnerabilities without undue delay, alert the authorities where there is a significant cybersecurity risk, and inform authorities and users if the manufacturer stops operating (Article 20(3) to (6)).

Online shops are distributors when they sell a third party's product without changing it. Recital 20 adds that merely hosting software on open repositories, including package managers, is not making it available on the market.

When you become the manufacturer

Two rules turn others into manufacturers, with the full duties of Articles 13 and 14:

• an importer or distributor that places a product on the market under its own name or trademark, or carries out a substantial modification of a product already on the market (Article 21);
• anyone else who carries out a substantial modification and makes the product available, for the affected part or, if the change affects the product's cybersecurity as a whole, for the whole product (Article 22).

White-label deals are the classic case. A Belgian brand that sells a camera made in Asia under its own logo is the manufacturer, not the importer.

Traceability (Article 23)

Every economic operator must, on request, name the operator that supplied it and, where available, those it supplied, for ten years after each supply (Article 23).

Open source

The CRA only applies to products made available "in the course of a commercial activity" (Article 3, point (22)). Recitals 15 to 20 explain what that means for free and open-source software:

• open-source software that is not monetised by its manufacturer is not supplied in the course of a commercial activity (recital 18);
• an open-source component intended for integration by others is made available on the market only if its original manufacturer monetises it (recital 18);
• financial support from, or contributions by, companies do not by themselves make the activity commercial, nor do regular releases (recital 18);
• people who contribute code to projects that are not under their responsibility are not caught (recital 18);
• examples of monetisation include charging for technical support beyond cost recovery, or requiring personal data as a condition for use for purposes other than security, compatibility or interoperability (recital 15).

Open-source software stewards carry a light regime (Article 24). They must have a documented, verifiable cybersecurity policy that fosters secure development, effective handling of vulnerabilities and voluntary reporting, and cooperate with market surveillance authorities. They report actively exploited vulnerabilities under Article 14(1) to the extent they are involved in development, and severe incidents under Article 14(3) and (8) when their own development infrastructure is affected (Article 24(3)). Stewards cannot be fined under the CRA (Article 64(10)(b)), and they may not affix the CE marking (recital 19). Recital 19 names foundations and entities that develop and publish open-source software in a business context as examples.

The company that builds open source into its product remains the manufacturer of the whole product. It must exercise due diligence on third-party components, including open-source components not made available in a commercial activity (Article 13(5)), report vulnerabilities it finds in them to the maintainer and share its fixes where appropriate (Article 13(6)). The Commission may set up voluntary security attestation programmes for open-source software to support that due diligence (Article 25). Open-source products in an Annex III category may use self-assessment if their technical documentation is public (Article 32(5)).

Fines

Breaches of Articles 18 to 23 can lead to fines of up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher (Article 64(3)). Importers and distributors that are treated as manufacturers under Article 21 face the manufacturer's ceiling of EUR 15 million or 2.5% (Article 64(2)).

In practice

A Dutch-language webshop sells smart plugs from a Chinese manufacturer that has no EU establishment. The webshop imports them itself, so it is the importer. It checks the conformity assessment, the CE marking, the declaration of conformity, user information in a language its customers easily understand and the stated support period, and puts its own contact details on the box. If it orders a version with its own brand printed on the plug, it becomes the manufacturer.

A systems integrator buys routers, loads its own firmware with remote management and sells them to SMEs. Replacing the firmware likely changes the security of the product as a whole. Under Article 21 or 22 the integrator then takes on the manufacturer's duties for the product.

A software company publishes a logging library on a public repository under an open-source licence and earns nothing from it. That is not a commercial activity. The same company sells a monitoring appliance that includes the library. For the appliance it is the manufacturer and must handle vulnerabilities in the library as part of its product.

A foundation hosts and steers a widely used open-source web server, with paid members from industry. It may well be an open-source software steward. It needs a cybersecurity policy and must cooperate with authorities, but it cannot be fined.

Practical steps

1. Map your role for each product line: manufacturer, importer, distributor or authorised representative.
2. Check white-label and own-brand deals: they make you the manufacturer.
3. Build an intake checklist for goods you import or distribute, based on Articles 19(2) and 20(2).
4. Keep supplier and customer records for ten years.
5. For each open-source component, record its origin, licence, maintainer and how you will follow its vulnerabilities.

Clauses to add

• Supply and manufacturing agreements: the supplier warrants conformity with Annex I, states the product class and conformity route, provides the technical documentation to authorities on request, commits to a support period and to security updates free of charge, shares its software bill of materials, and notifies you of vulnerabilities and incidents in time for your own reporting. See manufacturing and supply agreements.
• Distribution and reseller agreements: no own-brand relabelling or firmware changes without consent, a duty to pass on security notices to customers, cooperation on recalls and a ten-year record of sales. See distribution and reseller agreements.
• Authorised representative mandates: the minimum tasks of Article 18(3), in writing.
• Software licences and development contracts: who is the manufacturer, who reports, and who maintains which component. See licensing agreements and protecting software IP.

Frequently asked questions

We only resell. Do we need to read the technical documentation?

No. A distributor verifies the CE marking and the documents listed in Article 20(2). The importer must ensure the technical documentation has been drawn up and can be provided to the authorities.

Is publishing our code on a public repository "placing on the market"?

Not by itself. Hosting on open repositories is not making available on the market (recital 20), and open source that is not monetised is not supplied in a commercial activity (recital 18).

Can we push CRA duties onto our supplier by contract?

You can allocate costs, information and cooperation, and claim recourse. You cannot contract out of your own legal role: the importer, distributor or manufacturer remains responsible towards the authorities.

Does the CRA apply to products we import today?

The product rules apply from 11 December 2027 to products placed on the market from that date. Units placed on the market earlier are only caught if substantially modified, but the reporting duty of Article 14 already applies to the manufacturer.

How this connects

The CRA shifts risk along the supply chain, and contracts decide who carries it. Our commercial contracts team reviews and drafts supply, distribution and licence agreements with the CRA roles in mind. Contract review checks a contract stack against our clause library, Document Studio prepares the amendments, and the rights and obligations register keeps track of support periods, notice duties and record keeping.

At a glance

Provisions cited: Regulation (EU) 2024/2847, Articles 3, 13(5) and (6), 18 to 25, 32(5), 64(2), (3) and (10) and 71; recitals 15, 18, 19 and 20.

Key dates: reporting by manufacturers since 11 September 2026; duties of importers, distributors, authorised representatives and open-source software stewards from 11 December 2027.

The series: part I, products and classes and part II, vulnerability handling and reporting. Related: open source after the EU Open Source Strategy, manufacturing and supply agreements, distribution and reseller agreements and licensing agreements.