Cyber Resilience Act · Articles 19 to 21
The CRA importer and distributor pack: seven documents
The duties Articles 19 to 21 lay on an importer or distributor of products with digital elements, as seven documents for the whole organisation: the procedure, the register, the requests and the retention, delivered as PDF and DOCX.
€2,500
Documents by email within minutes; add them to a free workspace whenever you like.
excl. VAT · one payment · invoice from Paddle · no account
The 7 documents
Every document by name, one line on what it settles, and the point of the Regulation it satisfies.
1 · Articles 19, 20 and 21
Supply-chain role determination
Which role the organisation holds for each product line, with the reasoning.
2 · Articles 19(2) and 20(2)
Due diligence procedure for products with digital elements
The checks made before a product is placed or made available on the market.
3 · Articles 19(2), 20(2) and 21
Due diligence register
One row per product line: the checks made, the date, the evidence, the person.
4 · Articles 19(2) and 20(2)
Manufacturer information request
The letter that asks a manufacturer for the declaration, the file and the support period.
5 · Articles 19(3), 19(5), 20(3) and 20(4)
Non-conformity, withdrawal and recall procedure
What happens when a product is found non-conforming: the stop, the corrective measures, the withdrawal or recall.
6 · Articles 19(6), 20(4) and 20(6)
Vulnerability and cessation reporting duties
How a vulnerability or a cessation of the manufacturer's business is reported, and to whom.
7 · Article 19(6)
Declaration retention and documentation availability
How long the declaration and the documentation stay available to the authorities, and where.
A sample page
The first page of the Due diligence procedure for products with digital elements, as it arrives: PDF and DOCX, the generic placeholders in square brackets are what your workspace fills in.
Who it is for
- An importer or distributor of hardware or software with digital elements placed on the EU market.
- A reseller or integrator who has to show due diligence on the products it passes on, from 11 December 2027.
- A company that is both a manufacturer and a distributor of others' products, for the second role.
Who it is not for
- A manufacturer: the technical file pack carries your duties, not this one.
- A company that only uses products with digital elements internally.
- A team that wants the register kept as its suppliers change: that is the workspace's job.
How delivery works
1. Pay
Paddle takes the payment in the overlay on this page and issues the invoice, VAT handled for your country.
2. Receive
Within minutes an email carries a link, good for seven days, to the set as PDF and DOCX.
3. Use, or claim
Edit the DOCX yourself, or create a free workspace with the same email: the purchase attaches to it and the documents are drafted again from your own product record.
In a workspace
A workspace created, or an owner signing in, with the buyer's address claims the purchase once. The same 7 documents are then drafted from the product you register, kept current as the record changes, and exported with the audit trail. The trial is 14 days, no card.
Regulation references
Every document names the article or annex point it satisfies; the Official Journal text is the source, read in English.
- Articles 19, 20 and 21
- Articles 19(2) and 20(2)
- Articles 19(2), 20(2) and 21
- Articles 19(2) and 20(2)
- Articles 19(3), 19(5), 20(3) and 20(4)
- Articles 19(6), 20(4) and 20(6)
- Article 19(6)
The terms
- One payment; the invoice comes from Paddle, our merchant of record, with VAT for your country.
- The documents are yours to edit and keep; a link that has expired is re-sent on request.
- Cancellation and refund terms are on the cancellation page. Cancellation and refund
Questions
- What is the difference between an importer and a distributor here?
- An importer places a product from outside the EU on the market and carries Article 19; a distributor makes it available on the market and carries Article 20. The role determination in the pack decides which you are, per product line.
- Do I need an account to buy it?
- No. Paddle takes the payment on this page and the documents arrive by email. A free workspace can claim the purchase later if you want the register kept live.
- Is one pack enough for several product lines?
- Yes. The duties are on the organisation; the register lists every product line, and the manufacturer request is sent per manufacturer.
- In which language are the documents?
- English, the language every market surveillance authority accepts; the page and the support are in yours.
- What does the workspace add?
- The register as live records per supplier, the requests tracked to an answer, the non-conformity procedure as a task with its dates, and an export with the audit trail.
The other path
€249 a month runs the same file live: register the product, the workspace drafts every document from its record, keeps the clocks and stays current.
Start free, 14 days, no card