The CRA reaches you even if you did not build it. €2,500 once.

What the Regulation asks of you

1. If you import into the Union · Article 19

   Before the product is placed on the market you establish that the manufacturer carried out the conformity assessment and drew up the technical documentation, that the CE marking is affixed, that the declaration of conformity and the Annex II user information are there in a language users understand, and that the manufacturer's details and vulnerability contact are present. Your own name and address go on the product too. You keep the declaration for ten years or the support period, whichever is longer.

2. If you make available on the market · Article 20

   You act with due care, and before the product is made available you verify the CE marking and that the manufacturer and importer did their part. If you have reason to believe a product does not conform, it does not go on sale. You pass vulnerabilities to the manufacturer without undue delay, and you tell the authorities when a manufacturer stops trading.

3. If you rebrand or modify, you are the manufacturer · Article 21

   Place a product on the market under your own name or trademark, or substantially modify one already placed, and the Regulation treats you as its manufacturer. Articles 13 and 14 then apply in full: the Annex VII technical file, the support period, the reporting duty. This is the trap the pack finds first, because it changes everything else.

What you get

7 controlled documents, drafted from the register you fill in. Each is versioned, approved and hash-chained in your organization, and exports as a PDF with the sha256 of the approved text in the footer.

The documents are drafted in English, under the titles below. The Regulation fixes no language for them; the Annex II user information the pack asks you to check has to be in a language your users understand, and that is a check on the manufacturer's product, not on these documents.

1. 1

   Supply-chain role determination · Articles 19, 20 and 21

2. 2

   Due diligence procedure for products with digital elements · Articles 19(2) and 20(2)

3. 3

   Due diligence register · Articles 19(2), 20(2) and 21

4. 4

   Manufacturer information request · Articles 19(2) and 20(2)

5. 5

   Non-conformity, withdrawal and recall procedure · Articles 19(3), 19(5), 20(3) and 20(4)

6. 6

   Vulnerability and cessation reporting duties · Articles 19(6), 20(4) and 20(6)

7. 7

   Declaration retention and documentation availability · Article 19(6)

The one that catches people

The register asks, for every product, whose brand is on it. If the answer is yours, Article 21 makes you the manufacturer of that product and the pack says so in writing, at the top of the role determination. That is a far bigger obligation than verification, and it is better to find it now than to find it from a market surveillance authority. The technical file for those products is a separate pack.

What it is not

• Not the manufacturer's technical documentation. You do not owe one unless Article 21 makes you the manufacturer, and then you need the technical file pack instead.
• Not a substitute for asking your suppliers. The pack writes the letter and holds the answers; the manufacturers still have to reply, and one that does not is itself a finding.
• Not legal advice. It is the documentation the Regulation implies, drafted from your facts, for you to complete and approve.
• Not a subscription. Keeping the register current as your catalogue changes is what the €249/mo product is for. Your choice.

Articles 19 to 21 are short enough to read yourself: Regulation (EU) 2024/2847. This page is not legal advice.