Economic Operator (CRA)

The EU Cyber Resilience Act uses 'economic operator' as the umbrella term for all entities in the commercial supply chain who have a role in bringing a product with digital elements to the EU market. The CRA defines four types of economic operator: manufacturers (who design, develop, and produce products); authorised representatives (EU-established entities designated by non-EU manufacturers to act on their behalf); importers (EU-established entities who place a non-EU manufacturer's products on the EU market); and distributors (entities in the supply chain who make products available on the market after a manufacturer or importer). Each type has distinct but overlapping obligations.

The manufacturer bears the primary and most extensive obligations: conducting risk assessments, implementing Annex I requirements, establishing CVD processes, generating SBOMs, affixing CE marking, and providing security updates. The importer must verify that the manufacturer has completed conformity assessment, that the product bears the CE marking, and that the manufacturer's contact details are on the product. If an importer has reason to believe a product is not compliant, they must not place it on the market. The distributor must similarly verify CE marking and documentation before making products available. Crucially, if a manufacturer cannot be identified, importers or distributors can become responsible for manufacturer obligations.

Non-EU manufacturers who place products on the EU market must designate an authorised representative established in the EU before market placement. The authorised representative acts as the regulatory point of contact within the EU: they receive and handle communications from market surveillance authorities, hold a copy of the technical documentation, and are listed in the Declaration of Conformity. Non-EU manufacturers who fail to designate an authorised representative are non-compliant, and importers who knowingly place such products on the EU market share liability. The authorised representative does not acquire the substantive technical obligations of the manufacturer but can face liability for misrepresentation.

The most common economic operator error is assuming that obligations flow only to the manufacturer and that importers and distributors are passive bystanders. The CRA imposes active verification duties on importers and distributors: they must not place or make available products that they have reason to believe are non-compliant. Importers who source products from non-EU manufacturers without verifying CVD policy compliance, CE marking, and Declaration of Conformity completeness are themselves non-compliant. Another error is failing to designate an authorised representative before market placement — this is a pre-condition for legal EU market access for non-EU manufacturers, not an administrative formality that can be addressed after the fact.