Distributor Obligations Under the Cyber Resilience Act

A distributor is any entity in the supply chain other than the manufacturer or importer that makes a product with digital elements available on the EU market. This covers retailers, resellers, wholesalers, and online marketplaces that sell third-party products to EU consumers.

The key distinction from an importer is that the distributor makes products available on the market — typically through an existing EU supply chain — rather than placing them on the market for the first time. Retailers, department stores, electronics resellers, and online platforms are the most common distributor category under the CRA.

Distributors who act only as passive intermediaries — passing products from the supply chain to end users without modification — have lighter obligations than manufacturers and importers. However, 'passive' is interpreted strictly: any modification of the product, its packaging, or its labelling that could affect compliance converts the distributor to a manufacturer under Article 19.

Before making a product available on the EU market, distributors must verify that the product bears the CE marking and that the required documentation accompanies the product. Specifically, distributors should check:

1. That the CE marking is affixed to the product or its packaging
2. That the product is accompanied by required information under Annex II
3. That the manufacturer's name and contact details are indicated
4. That where required, the authorised representative's details are provided

Distributors are not required to conduct deep technical assessments of manufacturer compliance — their verification obligation is primarily documentary and visual. However, where a distributor has reason to believe a product is non-compliant — for example, if the CE marking appears incorrectly applied or if there are obvious security concerns — they must not make the product available until the concern is resolved.

Article 18 requires distributors to ensure that while a product is in their possession, storage and transport conditions do not compromise the product's compliance. For physical products with digital elements, this primarily means ensuring that products are stored and handled in ways that prevent physical tampering with security features.

For software products distributed digitally, distributors must ensure that distribution mechanisms (download links, update servers, application stores) maintain the integrity of the software. Tampered or modified software distributed under the manufacturer's name creates serious compliance risks for the distributor.

Distributors using third-party logistics or distribution platforms should include appropriate contractual requirements regarding product integrity in their logistics agreements.

Where a distributor has reason to believe that a product they have made available on the market does not meet CRA requirements, they must immediately inform the manufacturer or importer and ensure that corrective action is taken. Where the risk is serious, the distributor must also immediately inform national market surveillance authorities.

Distributors must cooperate with national authorities on their request, providing information and documentation necessary to verify compliance. This includes providing records of supply chain transactions, product documentation, and communications with manufacturers and importers.

Where corrective action requires product recall or withdrawal, distributors must cooperate with the recall process — for example, by ceasing sales, contacting customers who purchased affected products, and facilitating returns where necessary.

Distributors must be able to identify the manufacturer and importer for any product they make available. This traceability requirement exists to enable authorities to trace non-compliant products back to their source and to enable recalls to be executed effectively.

Practically, distributors should maintain records of their suppliers, the products they supply, and the relevant compliance documentation provided. Purchase orders, delivery records, and supplier documentation should be retained for a sufficient period to enable traceability. Many distributors maintain these records as part of normal commercial practice, but the CRA creates a legal obligation to ensure traceability specifically for compliance purposes.

Distributors operating at scale — particularly large retailers and online marketplaces — should consider whether their existing supplier management and documentation systems are adequate to meet this traceability requirement across their full product range.