The CRA's 24-hour reporting duty has applied since 11 September 2026. Check whether it reaches you
Start the system

For importers and distributorsNACE 46.51, 46.52, all of the EU

You sell someone else's product. The CRA still asks you to check it.

From 11 December 2027 the Cyber Resilience Act has importers and distributors verify each product before it reaches a customer.

Start your compliance system Read the importer and distributor duties
Example data

The rules that reach you

What reaches an importer or distributor, and from when

One law asks you to check each connected product, and another each machine.

Cyber Resilience Act

Regulation (EU) 2024/2847 · Products with digital elements

Every product you sell

Articles 19 and 20 have importers and distributors check the manufacturer's work before a product reaches a customer.

ImporterConformity assessed, technical documentation drawn up, CE mark and documents presentArt 19(2)
DistributorCE mark, declaration and user information present, manufacturer and importer done their partArt 20(2)
Your brandSell it under your own name and you are the manufacturerArt 21
VulnerabilitiesTell the manufacturer without undue delay, and the authorities on a significant riskArt 19(5)
Art 19Art 20In full from

Machinery Regulation

Regulation (EU) 2023/1230

If you sell machinery

The Machinery Regulation sets its own checks for importers and distributors, and your own brand on a machine makes you its manufacturer.

Art 13 to 16Art 17Applies from

In numbers

Who it reaches, when, and what it asks

46,498

wholesalers of computers, electronics and telecom equipment in the EU.

Source: Eurostat business statistics 2024, NACE 46.51 and 46.52

until the Cyber Resilience Act applies in full.

Source: Regulation (EU) 2024/2847, Article 71(2)

14

checks Articles 19 to 21 ask of an importer or distributor, as our pack reads them.

Source: Regulation (EU) 2024/2847, Articles 19 to 21

What StandardOS does for an importer or distributor

Every product checked, and every check on record

Every tile is a screen in the product today.

Every product you supply, checked

Your role, the manufacturer's documents and each Article 19 or 20 check, recorded per product.

A route for every vulnerability

Each product's manufacturer contact, vulnerability contact and support period on file, so a report goes on without delay.

One technical file per product

Each product's tier, technical documentation, SBOM and support period, kept current as it changes.

Evidence from your own stack

12 read-only integrations, Microsoft Entra ID and Intune among them, read on a schedule.

One subscription

Every rule on this page, on one record.

ISO27001CRANIS2DORAISO42001AIACTISO9001MRGDPRDATAACTISO27701EAAISO14001PLDREDGPSRNIS2IRRoHSREACHWEEEPPWRWBBATPTDEUDREEDCER

The 2 on this page, and 25 more for the same price

€249/mo

Every framework included.

excl. VAT, per organization

  • Unlimited users, auditors included
  • 7 days free, no card, no sales call
Start your compliance system

Or one file, once: CRA importer and distributor pack, €1,200 · introductory price until 30 Nov 2026See the pack

Questions

What importers and distributors ask first

Short answers, each with the article it rests on.

When do the importer and distributor duties start?

On 11 December 2027, when the Regulation applies in full. A product placed on the market before then stays outside, unless it is substantially modified.

Art 71(2)Art 69(2)
We sell under our own brand. What changes?

Article 21 makes you the manufacturer: the technical file, the conformity assessment and the reporting duty are yours.

Art 21
What do we do when a customer reports a vulnerability?

Tell the manufacturer without undue delay, and the market surveillance authorities at once where the product presents a significant cybersecurity risk.

Art 19(5)Art 20(4)
Does the Machinery Regulation reach us too?

If you import or distribute machinery, yes, from 20 January 2027: Articles 13 to 16 set your checks, and Article 17 gives you a manufacturer's duties under your own brand.

Machinery Regulation Art 13 to 16Machinery Regulation Art 17

Check each product before it ships.

7 days free, no card and no sales call.

Start your compliance system Read the importer and distributor duties

This page in:DeutschFrançaisNederlandsEspañolDansk