Importers and distributors: your duties when you resell non-EU software or devices

Many companies make nothing — they just resell or import someone else's software and devices. It's easy to assume "the CRA doesn't concern us". It's not so: importers and distributors have their own duties (Art. 19–20), milder than a manufacturer's but real. And one thing can flip you straight into the manufacturer role. Let's get into it.

Importer vs distributor — who is who

The distinction is simple and determines which duties apply:

1. An importer places on the EU market a product from a manufacturer established outside the EU. It's the first link in the EU.
2. A distributor makes available a product that someone else (the manufacturer or importer) already placed on the EU market. It's further down the chain.

Importer duties (Art. 19)

An importer carries greater responsibility, because it lets a foreign product into the EU. Before placing it on the market, it must verify the manufacturer did its job:

1. that the product underwent conformity assessment and bears the CE marking,
2. that the technical documentation has been drawn up and the manufacturer will make it available,
3. that the product meets the essential requirements — and if it has reason to believe it doesn't, it must not place it on the market,
4. cooperate with authorities and report risks and vulnerabilities to the manufacturer and surveillance authorities.

Distributor duties (Art. 20)

A distributor acts with due care. Before making the product available:

1. it verifies the product bears the CE marking,
2. it verifies the manufacturer and any importer fulfilled their duties (e.g. documentation/instructions are included),
3. if it has reason to believe the product isn't in conformity, it doesn't make it available until that's remedied,
4. it reports risks and vulnerabilities to the manufacturer and authorities.

When you become a manufacturer (Art. 21)

This is the article's most important sentence. If you place the product on the market under your own name or trademark, or if you substantially modify it, you stop being "just" an importer or distributor and become a manufacturer with all its obligations (Art. 21). So you're flipped by:

1. rebranding — you sell a foreign product under your own brand,
2. substantial modification — you alter the product in a way that affects its conformity (not minor configuration, but a change that alters its security properties).

If this applies to you, also read 10 examples of who the CRA concerns and who the manufacturer is in custom work.

Example: a company reselling a foreign tool

Say you sell a software tool from a US maker in the EU. How it looks depends on what you do with it:

1. You sell it as-is, under the maker's brand → you're an importer (the maker is outside the EU). Verify CE, documentation and that the maker meets its duties; set up a way to pass reported problems to it.
2. You only distribute it further (someone else already imported it) → you're a distributor. Verify CE and that the importer/maker met their duties.
3. You sell it under your own brand (rebranding) or modify it → you become the manufacturer (Art. 21) with all obligations, including conformity assessment and reporting.

The same product, three different roles — depending on what you actually do with it. If you're unsure, 10 examples and the scope-checker help you place yourself.

The practical takeaway

As an importer/distributor you don't need to do the conformity assessment for the manufacturer — but you need to be able to verify the manufacturer did it, and to have a channel for reporting problems. In practice that means asking the manufacturer for the documents (CE, documentation, a reporting contact) and keeping a record. If you find a vulnerability, you know who to pass it to.

FAQ

1. Must an importer do the conformity assessment? No — that's the manufacturer's job. The importer must verify the manufacturer did it, and that CE and documentation are present (Art. 19).
2. What if the non-EU manufacturer won't cooperate? If you're not sure the product meets the requirements and documentation is available, you must not place/make it available — the risk falls on whoever lets it into the EU.
3. We put our own logo on the product — does that change anything? Yes, fundamentally: selling under your own brand makes you the manufacturer (Art. 21) with all obligations.
4. We're just storage/logistics, does this concern us? If you make the product available on the market in your own name, you're a distributor; pure transport without making it available on the market is a different category.

What to record for each product

A practical aid for importers and distributors alike: for each product, record whether it has CE, where the manufacturer's documentation is, the contact for reporting problems to the manufacturer, and a log of what you reported and when. Such an overview is exactly what proves, at an inspection, that you met your duties — and it also saves time on supplier questionnaires from your own customers.

Key point

You don't have to make anything for the CRA to apply. If you're the first to let a foreign product into the EU, you're an importer (Art. 19): verify CE, documentation and that the manufacturer did the conformity assessment — and don't place a non-compliant product. If you make it available further down the chain, you're a distributor (Art. 20): act with due care, verify CE and that duties are met. Both report risks and vulnerabilities to the manufacturer and authorities. And one thing can change everything: selling under your own brand or a substantial modification makes you the manufacturer with all its obligations (Art. 21). In practice you don't have to do the conformity assessment for the manufacturer — you need to be able to verify it was done, and keep an overview: CE, documentation, a reporting contact, and a record of what you reported and when. That same overview is your answer both at an inspection and to your own customers' questionnaires.

How CRAguard helps

A distributor or importer, too, will value one place that holds, per product, the manufacturer's documents, the reporting contact, and a record of what you reported and when — an audit trail that shows an authority or a customer you met your duties. Find out whether the CRA applies to you, or join the waitlist.

This article is informational and not legal advice. It is based on Regulation (EU) 2024/2847 (Art. 19 importers, Art. 20 distributors, Art. 21 cases where manufacturer obligations apply to importers and distributors) and the European Commission's guidance of 27 July 2026.