Who is affected
Who does the CRA apply to?
The CRA applies to all economic operators involved in placing products with digital elements on the EU market. Each role in the supply chain has specific obligations designed to ensure end-to-end cybersecurity.
- Manufacturers carry the primary responsibility. They must ensure products are designed, developed and maintained with appropriate cybersecurity measures. This includes conducting risk assessments, creating technical documentation, providing security updates and reporting vulnerabilities.
- Importers must verify that the manufacturer has carried out the proper conformity assessment, that the product bears the CE marking and that all required documentation is available. They serve as a crucial checkpoint before products reach the EU market.
- Distributors must act with due care when making products available on the market. They need to verify CE marking, ensure proper documentation is available and report any known non-compliance to market surveillance authorities.
