General Obligations of Economic Operators

Article 21 requires all economic operators — manufacturers, importers, authorised representatives, and distributors — to cooperate with national market surveillance authorities and other competent authorities on request. This is a broad obligation that encompasses:

• Providing access to technical documentation and compliance records
• Supplying information about the supply chain, including the identities of manufacturers, importers, and distributors
• Facilitating product testing and inspection by authorities
• Implementing corrective actions requested by authorities within specified timeframes
• Participating in investigations into suspected non-compliance or product risks

The cooperation obligation applies regardless of whether the economic operator is itself suspected of non-compliance. An importer who has no independent compliance failure may still be required to provide supply chain information to help authorities trace a non-compliant product to its source.

Article 21 requires economic operators to be able to identify who supplied a product to them and to whom they supplied it. This traceability obligation runs up and down the supply chain — operators must be able to trace products both forward (to the next entity in the chain) and backward (to the entity from whom they received it).

The traceability requirement must be fulfilled for a period of 10 years after placing the product on the market. This extended retention period is significant for record-keeping purposes — supply chain records must be maintained for the full decade even when commercial relationships have ended.

For complex supply chains involving multiple tiers of distributors or components from multiple suppliers, the traceability obligation creates a practical need for robust supply chain management systems. Electronic record-keeping with adequate data retention policies is likely necessary to meet this requirement at scale.

Article 21 creates a proactive information-sharing obligation: economic operators who know or have reason to believe that a product presents a risk to users must immediately inform the relevant national market surveillance authority and the other economic operators in the supply chain who are responsible for the product.

This obligation is not limited to confirmed non-compliance — it applies when an operator 'has reason to believe' a risk exists. This lower threshold means that credible concerns about product security should trigger information sharing even before full investigation. Operators should not wait for definitive proof of a vulnerability before notifying authorities if the available evidence suggests a serious risk.

The information-sharing obligation creates interdependencies within the supply chain: a distributor who learns of a security issue must not simply act unilaterally but must ensure that manufacturers, importers, and authorities are all informed.

Article 21's general obligations are applied in a risk-proportionate manner. The depth of cooperation, the frequency of supply chain monitoring, and the urgency of information sharing are all calibrated to the severity of the risk involved.

For low-risk products with no known issues, the general obligations are largely dormant — operators maintain records and cooperate if asked, but are not required to conduct active compliance monitoring beyond what Article 15 requires of manufacturers. For high-risk products or products where vulnerabilities have been identified, the Article 21 obligations become active and demanding.

The CRA's recitals make clear that economic operators are expected to take a risk-based approach to their obligations — allocating more compliance resources to products that present greater risks to users and society.

Article 21's general obligations complement and reinforce the specific obligations in Articles 16–19. Where those articles establish specific requirements for particular types of economic operator, Article 21 creates the general framework within which all operators must function.

For manufacturers, Article 21 reinforces the post-market monitoring and corrective action obligations in Article 15. For importers and distributors, it reinforces the verification and traceability obligations in Articles 17 and 18. For authorised representatives, it reinforces the cooperation obligations they owe by virtue of their appointment.

The general obligation framework in Article 21 also fills gaps — for example, where a novel supply chain arrangement does not fit neatly into the manufacturer/importer/distributor categories, Article 21's general obligations still apply to ensure that all parties in the chain bear some responsibility for compliance.