Importer Obligations Under the Cyber Resilience Act

Article 17 requires importers to perform due diligence before placing a non-EU-manufactured product on the EU market. Specifically, importers must verify that:

1. The manufacturer has performed the applicable conformity assessment procedure
2. The manufacturer has drawn up the technical documentation under Annex VII
3. The product bears the CE marking
4. The manufacturer has drawn up the EU Declaration of Conformity
5. The manufacturer has appointed an authorised representative (where required under Article 16)
6. The product is accompanied by the required user information under Article 13 and Annex II

This verification obligation makes the importer a compliance gatekeeper — they cannot simply pass through products without checking that manufacturers have met their obligations. Importers who knowingly place non-compliant products on the market can face penalties under Article 32.

If an importer finds that a product does not comply with the CRA essential requirements, or that the manufacturer has not completed the required conformity assessment, the importer must not place the product on the market until compliance is achieved. The importer must inform both the manufacturer and the market surveillance authorities of the non-compliance.

Where a product presents a serious risk, the importer must immediately inform the national market surveillance authority and the manufacturer. Importers should have processes for handling compliance holds — including storage of non-compliant products, communication with manufacturers, and documentation of the non-compliance findings.

This obligation creates a practical need for importers to have some technical competence in cybersecurity requirements, or to engage technical advisors who can assess manufacturer compliance claims. Simply accepting a manufacturer's declaration without meaningful verification may not meet the Article 17 standard.

Article 17 requires importers to ensure traceability — specifically, that their name, registered trade name or mark, and postal address (and website or email address where applicable) are indicated on the product or on its packaging. This enables market surveillance authorities and consumers to identify the EU entity responsible for the product's market entry.

For digital products where physical labelling is not practicable, these details may be provided in the accompanying documentation or in a prominent location on the product's digital interface. The importer's contact details must be in a language easily understood by end users and national authorities in the member state where the product is sold.

Importers must also keep copies of the EU Declaration of Conformity for 10 years after placing the product on the market, and must make these available to authorities on request.

Once a product is on the market, importers retain ongoing obligations. Where an importer has reason to believe a product no longer complies with the essential requirements — for example, because new vulnerabilities have been discovered or because the manufacturer has failed to provide security updates — the importer must take corrective action.

• Requiring the manufacturer to provide security updates or remediation
• Withdrawing the product from sale pending remediation
• Recalling products already in users' hands where they present a serious risk
• Notifying national market surveillance authorities of a risk

Importers should maintain ongoing communications with manufacturers to receive alerts about newly discovered vulnerabilities and available security updates. Supply agreements with non-EU manufacturers should include contractual obligations requiring manufacturers to inform importers of CRA-relevant events.

Article 17 permits importers to carry out sample testing of products that have been placed on the market and to investigate complaints. This is not a requirement to test every product, but rather an authorisation to conduct quality-control checks as part of the ongoing verification obligation.

Practically, importers serving high-volume markets should consider periodic testing of product samples to verify that the conformity documentation reflects the actual product. Discrepancies between declared specifications and actual product characteristics are a compliance risk — both for the manufacturer and for the importer who placed the product on the market.

Importers should document their verification activities, including records of documentation checks, sample testing results, and any communications with manufacturers regarding compliance issues. This documentation demonstrates due diligence in the event of a market surveillance investigation.