Roles and Duties

Roles depend on the product

The CRA uses product-law roles. It does not assign duties only by asking who wrote the code, who owns the repository, or who operates a service. The first question is whether a product with digital elements is made available on the Union market. The next question is what the actor does with that product.

The CRA calls the manufacturer, authorised representative, importer, distributor, and some other obligated persons economic operators. That term is useful because it keeps the roles tied to market activity. A person who only contributes code, hosts a repository, or provides unrelated support is not put into every CRA role by that fact alone.

The manufacturer is the anchor role

‘manufacturer’ means a natural or legal person who develops or manufactures products with digital elements or has products with digital elements designed, developed or manufactured, and markets them under its name or trademark, whether for payment, monetisation or free of charge;

Regulation (EU) 2024/2847, Article 3(13)

The definition has two parts. The actor must be connected to the product's development or manufacture, directly or through another party, and must market the product under its own name or trademark. The original software author is not always the manufacturer. A brand owner that has a product developed for it can be the manufacturer if it markets the product as its own.

This is why the main CRA duties sit with the manufacturer. The manufacturer is the actor the CRA treats as responsible for the product design, development, conformity, user information, support period, vulnerability handling, and reporting duties that follow from Articles 13 and 14.

Importers and distributors are supply-chain roles

An importer is established in the Union and places on the Union market a product with digital elements that bears the name or trademark of a person established outside the Union. The importer role exists because a non-EU manufacturer may be outside the immediate reach of EU market controls.

A distributor is another supply-chain actor, other than the manufacturer or importer, that makes a product available on the Union market without affecting its properties. The distributor role is narrower than the manufacturer role because the distributor is not the actor that designed, developed, or markets the product as its own.

Importer and distributor duties are still real CRA duties. They focus on whether the product has the expected signs of conformity, whether manufacturer and importer information is present, whether the product should be withheld when there is reason to believe it is not compliant, and cooperation with market surveillance authorities.

The authorised representative acts by mandate

An authorised representative is established in the Union and acts for the manufacturer only because the manufacturer has given it a written mandate. The mandate must specify the tasks. Appointment of an authorised representative does not move the manufacturer role itself.

This distinction matters in practice. The representative can be the EU-facing contact for specified tasks, such as providing documents to market surveillance authorities or cooperating on corrective action. The core duties that belong to designing, developing, producing, and keeping the product in conformity remain manufacturer duties.

Open source has two separate concepts

Free and open-source software is not outside the CRA in all cases. If a person places a free and open-source product with digital elements on the market under its own name or trademark in a commercial activity, that person can be the manufacturer for that product.

The CRA also creates a different role for open-source software that is published but not made available on the market in that sense. That role is the open-source software steward.

‘open-source software steward’ means a legal person, other than a manufacturer, that has the purpose or objective of systematically providing support on a sustained basis for the development of specific products with digital elements, qualifying as free and open-source software and intended for commercial activities, and that ensures the viability of those products;

Regulation (EU) 2024/2847, Article 3(14)

The steward role is therefore not a label for every maintainer or contributor. It applies to a legal person, for specific free and open-source software, when that person sustains the project and ensures its viability while not being the manufacturer for that product. The Commission describes the steward regime as tailored and lighter than the manufacturer regime.

Individual source-code contributors are treated differently again. The CRA does not apply to natural or legal persons who contribute source code to free and open-source software that is not under their responsibility.

Role changes

A role can change when the actor stops merely supplying another person's product and starts presenting or changing the product in a way that the CRA treats as manufacturer activity.

An importer or distributor shall be considered to be a manufacturer for the purposes of this Regulation and shall be subject to Articles 13 and 14, where that importer or distributor places a product with digital elements on the market under its name or trademark or carries out a substantial modification of a product with digital elements already placed on the market.

Regulation (EU) 2024/2847, Article 21

The same principle also applies beyond importers and distributors. A person other than the manufacturer, importer, or distributor is treated as the manufacturer if it carries out a substantial modification and makes the modified product available on the market. For that person, the manufacturer duties apply to the affected part of the product, or to the whole product if the modification affects the cybersecurity of the product as a whole.

A substantial modification is not every update, repair, or support activity. The CRA definition turns on whether the post-market change affects compliance with the essential cybersecurity requirements or changes the intended purpose for which the product was assessed. A security update that only reduces risk will usually point away from a role change. A feature change that changes intended purpose or increases the cybersecurity risk can point towards one.

These rules explain common boundaries. An EU-established actor that places a non-EU branded product on the Union market is normally an importer. A supply-chain actor that makes an unchanged product available is normally a distributor. An actor that uses its own name or trademark, or substantially modifies the product and makes it available, can become the manufacturer.