# Importers and distributors: your duties when you resell non-EU software or devices Canonical: https://craguard.eu/blog/importers-and-distributors-duties Language: en Last updated: 2026-09-02 - [CRAguard](https://craguard.eu/)/ - [Blog](https://craguard.eu/blog)/ - Importers and distributors: your duties when you resell non-EU software or devices 31 Aug 2026 · CRAguard Summary The CRA doesn't only place obligations on manufacturers. An importer (Art. 19) must not place a product on the market without CE and documentation and must verify the manufacturer carried out the conformity assessment. A distributor (Art. 20) acts with due care and verifies CE. Both report risks and vulnerabilities to the manufacturer and authorities. Note: if you sell a product under your own brand or substantially modify it, you become a manufacturer (Art. 21) with all the obligations. Many companies make nothing — they just **resell or import** someone else's software and devices. It's easy to assume "the CRA doesn't concern us". It's not so: importers and distributors have **their own duties** (Art. 19–20), milder than a manufacturer's but real. And one thing can flip you straight into the manufacturer role. Let's get into it. ## Importer vs distributor — who is who The distinction is simple and determines which duties apply: - An **importer** places on the EU market a product from a manufacturer **established outside the EU**. It's the first link in the EU. - A **distributor** makes available a product that someone else (the manufacturer or importer) already placed on the EU market. It's further down the chain. ## Importer duties (Art. 19) An importer carries greater responsibility, because it lets a foreign product into the EU. Before placing it on the market, it must **verify the manufacturer did its job**: - that the product underwent **conformity assessment** and bears the **CE marking**, - that the **technical documentation** has been drawn up and the manufacturer will make it available, - that the product meets the essential requirements — and if it has reason to believe it doesn't, it **must not place it on the market**, - **cooperate with authorities** and **report risks and vulnerabilities** to the manufacturer and surveillance authorities. Scope-checker ### Find out whether the CRA applies to you Six questions, two minutes, no account. Get your product class and first steps. [Start the scope-checker](https://craguard.eu/checker) ## Distributor duties (Art. 20) A distributor acts with **due care**. Before making the product available: - it verifies the product bears the **CE marking**, - it verifies the manufacturer and any importer **fulfilled their duties** (e.g. documentation/instructions are included), - if it has reason to believe the product isn't in conformity, it **doesn't make it available** until that's remedied, - it **reports risks and vulnerabilities** to the manufacturer and authorities. ## When you become a manufacturer (Art. 21) This is the article's most important sentence. **If you place the product on the market under your own name or trademark, or if you substantially modify it**, you stop being "just" an importer or distributor and **become a manufacturer** with all its obligations (Art. 21). So you're flipped by: - **rebranding** — you sell a foreign product under your own brand, - **substantial modification** — you alter the product in a way that affects its conformity (not minor configuration, but a change that alters its security properties). If this applies to you, also read [10 examples of who the CRA concerns](https://craguard.eu/blog/does-the-cra-apply-to-you-10-examples) and [who the manufacturer is in custom work](https://craguard.eu/blog/custom-software-who-is-the-manufacturer). ## Example: a company reselling a foreign tool Say you sell a software tool from a US maker in the EU. How it looks depends on what you do with it: - **You sell it as-is, under the maker's brand** → you're an **importer** (the maker is outside the EU). Verify CE, documentation and that the maker meets its duties; set up a way to pass reported problems to it. - **You only distribute it further** (someone else already imported it) → you're a **distributor**. Verify CE and that the importer/maker met their duties. - **You sell it under your own brand** (rebranding) or modify it → you **become the manufacturer** (Art. 21) with all obligations, including conformity assessment and reporting. The same product, three different roles — depending on what you actually do with it. If you're unsure, [10 examples](https://craguard.eu/blog/does-the-cra-apply-to-you-10-examples) and the [scope-checker](https://craguard.eu/checker) help you place yourself. ## The practical takeaway As an importer/distributor you don't need to do the conformity assessment for the manufacturer — but you need to be able to **verify** the manufacturer did it, and to have a channel for reporting problems. In practice that means asking the manufacturer for the documents (CE, documentation, a reporting contact) and keeping a record. If you find a vulnerability, you know who to pass it to. ## FAQ - **Must an importer do the conformity assessment?** No — that's the manufacturer's job. The importer must **verify** the manufacturer did it, and that CE and documentation are present (Art. 19). - **What if the non-EU manufacturer won't cooperate?** If you're not sure the product meets the requirements and documentation is available, you must not place/make it available — the risk falls on whoever lets it into the EU. - **We put our own logo on the product — does that change anything?** Yes, fundamentally: selling under your own brand makes you the manufacturer (Art. 21) with all obligations. - **We're just storage/logistics, does this concern us?** If you make the product available on the market in your own name, you're a distributor; pure transport without making it available on the market is a different category. ## What to record for each product A practical aid for importers and distributors alike: for each product, record whether it has CE, where the manufacturer's documentation is, the contact for reporting problems to the manufacturer, and a log of what you reported and when. Such an overview is exactly what proves, at an inspection, that you met your duties — and it also saves time on supplier questionnaires from your own customers. ## Key point You don't have to make anything for the CRA to apply. If you're the first to let a foreign product into the EU, you're an **importer** (Art. 19): verify CE, documentation and that the manufacturer did the conformity assessment — and don't place a non-compliant product. If you make it available further down the chain, you're a **distributor** (Art. 20): act with due care, verify CE and that duties are met. Both report risks and vulnerabilities to the manufacturer and authorities. And one thing can change everything: selling **under your own brand** or a **substantial modification** makes you the manufacturer with all its obligations (Art. 21). In practice you don't have to do the conformity assessment for the manufacturer — you need to be able to **verify** it was done, and keep an overview: CE, documentation, a reporting contact, and a record of what you reported and when. That same overview is your answer both at an inspection and to your own customers' questionnaires. ## How CRAguard helps A distributor or importer, too, will value one place that holds, per product, the manufacturer's documents, the reporting contact, and a record of what you reported and when — an audit trail that shows an authority or a customer you met your duties. [Find out whether the CRA applies to you](https://craguard.eu/checker), or [join the waitlist](https://craguard.eu/#waitlist). *This article is informational and not legal advice. It is based on Regulation (EU) 2024/2847 (Art. 19 importers, Art. 20 distributors, Art. 21 cases where manufacturer obligations apply to importers and distributors) and the European Commission's guidance of 27 July 2026.* Scope-checker ### Find out whether the CRA applies to you Six questions, two minutes, no account. Get your product class and first steps. [Start the scope-checker](https://craguard.eu/checker) ## Sources - [EUR-Lex — Regulation (EU) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj) - [ENISA — Single Reporting Platform](https://www.enisa.europa.eu/) --- Source: CRAguard — https://craguard.eu