Economic operators, market surveillance, and penalties

Importers and distributors

Importers may only place on the market products that comply with the essential requirements. Before doing so they must verify that the manufacturer carried out the appropriate conformity assessment, drew up the technical documentation, affixed the CE marking, and met its identification and Annex II information duties. Importers add their own name and contact details to the product or its documentation and keep a copy of the Declaration of Conformity for at least ten years or the support period, whichever is longer. Distributors act with due care: before making a product available they verify the CE marking is present and that manufacturer and importer met their marking and information duties. Both must act, inform the manufacturer, and alert market surveillance authorities when they believe a product is non-conforming or presents a significant cybersecurity risk.

Becoming the manufacturer without building anything

An importer or distributor is considered a manufacturer, taking on the full Article 13 and 14 duty set, when it places a product on the market under its own name or trademark, or carries out a substantial modification of a product already placed on the market. Any other person who substantially modifies a product and makes it available is likewise treated as a manufacturer for the modified product. White-labelling is therefore never a compliance shortcut: the brand on the box owns the obligations. Authorised representatives may perform delegated tasks for a manufacturer — keeping documentation at the disposal of authorities, cooperating with them — but the mandate cannot delegate the design-stage duties.

Who-is-the-manufacturer questions hinge on two acts: selling under your own name or trademark, and substantial modification. Either one transfers the full obligation set.

Open-source stewards and market surveillance

Open-source software stewards — legal persons other than manufacturers that systematically support the development of free and open-source products intended for commercial activities — carry a light regime under Article 24: put in place and document a cybersecurity policy including vulnerability handling, cooperate with market surveillance authorities, and report under Article 14 to the extent they are involved in the development. Stewards are not subject to administrative fines under the CRA. Market surveillance authorities under Article 52 can require corrective action, and where a product presents a significant cybersecurity risk, order withdrawal or recall; the Union safeguard procedure resolves cross-border disagreement between Member States, and coordinated sweeps can target categories of products.

The penalty ladder

Article 64 caps administrative fines in three tiers, each the higher of a fixed sum and a share of worldwide annual turnover for the preceding financial year. Non-compliance with the Annex I essential requirements or the Article 13 and 14 obligations reaches 15 million euro or 2.5 percent. Non-compliance with any other obligation of the regulation — importer, distributor, documentation and marking duties among them — reaches 10 million euro or 2 percent. Supplying incorrect, incomplete or misleading information to notified bodies and market surveillance authorities reaches 5 million euro or 1 percent. Authorities calibrate actual fines case by case, considering the nature and gravity of the infringement, and Member States lay down the rules within these caps, with special regard for SMEs including startups.