Cyber Resilience Act · Articles 19 to 21
The CRA importer and distributor pack: seven documents
The duties Articles 19 to 21 lay on an importer or distributor of products with digital elements, as seven documents for the whole organisation: the procedure, the register, the requests and the retention, delivered as PDF and DOCX.
List price €1,800
€1,200
33% off the list price, introductory, until 30 Nov 2026Documents by email within minutes; add them to a free workspace whenever you like.
excl. VAT · one payment · invoice from Paddle · no account
- Supply-chain role determination
- Due diligence procedure for products with digital elements
- Due diligence register
- Manufacturer information request
- Non-conformity, withdrawal and recall procedure
- Vulnerability and cessation reporting duties
- Declaration retention and documentation availability
The 7 documents
Every document by name, one line on what it settles, and the point of the Regulation it satisfies.
Articles 19, 20 and 21
Supply-chain role determination
Which role the organisation holds for each product line, with the reasoning.
Articles 19(2) and 20(2)
Due diligence procedure for products with digital elements
The checks made before a product is placed or made available on the market.
Articles 19(2), 20(2) and 21
Due diligence register
One row per product line: the checks made, the date, the evidence, the person.
Articles 19(2) and 20(2)
Manufacturer information request
The letter that asks a manufacturer for the declaration, the file and the support period.
Articles 19(3), 19(5), 20(3) and 20(4)
Non-conformity, withdrawal and recall procedure
What happens when a product is found non-conforming: the stop, the corrective measures, the withdrawal or recall.
Articles 19(6), 20(4) and 20(6)
Vulnerability and cessation reporting duties
How a vulnerability or a cessation of the manufacturer's business is reported, and to whom.
Article 19(6)
Declaration retention and documentation availability
How long the declaration and the documentation stay available to the authorities, and where.
What you get
A sample page
The first page of the Due diligence procedure for products with digital elements, as it arrives: PDF and DOCX, the generic placeholders in square brackets are what your workspace fills in.

Regulation references
Every document names the article or annex point it satisfies; the Official Journal text is the source, read in English.
- Articles 19, 20 and 21
- Articles 19(2) and 20(2)
- Articles 19(2), 20(2) and 21
- Articles 19(2) and 20(2)
- Articles 19(3), 19(5), 20(3) and 20(4)
- Articles 19(6), 20(4) and 20(6)
- Article 19(6)
In a workspace
A workspace created, or an owner signing in, with the buyer's address claims the purchase once. The same 7 documents are then drafted from the product you register, kept current as the record changes, and exported with the audit trail. The trial is 7 days, no card.
The terms
- One payment; the invoice comes from Paddle, our merchant of record, with VAT for your country.
- The documents are yours to edit and keep; a link that has expired is re-sent on request.
- Cancellation and refund terms are on the cancellation page. Cancellation and refund
Who it is for
- An importer or distributor of hardware or software with digital elements placed on the EU market.
- A reseller or integrator who has to show due diligence on the products it passes on, from 11 December 2027.
- A company that is both a manufacturer and a distributor of others' products, for the second role.
Who it is not for
- A manufacturer: the technical file pack carries your duties, not this one.
- A company that only uses products with digital elements internally.
- A team that wants the register kept as its suppliers change: that is the workspace's job.
How delivery works
1. Pay
Paddle takes the payment in the overlay on this page and issues the invoice, VAT handled for your country.
2. Receive
Within minutes an email carries a link, good for 30 days, to the set as PDF and DOCX.
3. Use, or claim
Edit the DOCX yourself, or create a free workspace with the same email: the purchase attaches to it and the documents are drafted again from your own product record.
Questions
- What is the difference between an importer and a distributor here?
- An importer places a product from outside the EU on the market and carries Article 19; a distributor makes it available on the market and carries Article 20. The role determination in the pack decides which you are, per product line.
- Do I need an account to buy it?
- No. Paddle takes the payment on this page and the documents arrive by email. A free workspace can claim the purchase later if you want the register kept live.
- Is one pack enough for several product lines?
- Yes. The duties are on the organisation; the register lists every product line, and the manufacturer request is sent per manufacturer.
- In which language are the documents?
- English, and every document is DOCX as well as PDF so it can be translated: on a reasoned request a market surveillance authority can ask for the documentation in a language that authority easily understands. The page and the support are in yours.
- What does the workspace add?
- The register as live records per supplier, the requests tracked to an answer, the non-conformity procedure as a task with its dates, and an export with the audit trail.
The other path
€249 a month runs the same file live: register the product, the workspace drafts every document from its record, keeps the clocks and stays current.
Open the workspace