The CRA's 24-hour reporting duty has applied since 11 September 2026.

Marketplace

Cyber Resilience Act · Articles 19 to 21

The CRA importer and distributor pack: seven documents

CRAApplies from 11 Dec 2027

The duties Articles 19 to 21 lay on an importer or distributor of products with digital elements, as seven documents for the whole organisation: the procedure, the register, the requests and the retention, delivered as PDF and DOCX.

List price €1,800

€1,200

33% off the list price, introductory, until 30 Nov 2026

Documents by email within minutes; add them to a free workspace whenever you like.

excl. VAT · one payment · invoice from Paddle · no account

  1. Supply-chain role determination
  2. Due diligence procedure for products with digital elements
  3. Due diligence register
  4. Manufacturer information request
  5. Non-conformity, withdrawal and recall procedure
  6. Vulnerability and cessation reporting duties
  7. Declaration retention and documentation availability

The 7 documents

Every document by name, one line on what it settles, and the point of the Regulation it satisfies.

  1. Articles 19, 20 and 21

  2. Articles 19(2) and 20(2)

  3. Articles 19(2), 20(2) and 21

  4. Articles 19(2) and 20(2)

  5. Articles 19(3), 19(5), 20(3) and 20(4)

  6. Articles 19(6), 20(4) and 20(6)

  7. Article 19(6)

What you get

A sample page

The first page of the Due diligence procedure for products with digital elements, as it arrives: PDF and DOCX, the generic placeholders in square brackets are what your workspace fills in.

First page of the Due diligence procedure for products with digital elements, a sample

Regulation references

Every document names the article or annex point it satisfies; the Official Journal text is the source, read in English.

  • Articles 19, 20 and 21
  • Articles 19(2) and 20(2)
  • Articles 19(2), 20(2) and 21
  • Articles 19(2) and 20(2)
  • Articles 19(3), 19(5), 20(3) and 20(4)
  • Articles 19(6), 20(4) and 20(6)
  • Article 19(6)

In a workspace

A workspace created, or an owner signing in, with the buyer's address claims the purchase once. The same 7 documents are then drafted from the product you register, kept current as the record changes, and exported with the audit trail. The trial is 7 days, no card.

The terms

  • One payment; the invoice comes from Paddle, our merchant of record, with VAT for your country.
  • The documents are yours to edit and keep; a link that has expired is re-sent on request.
  • Cancellation and refund terms are on the cancellation page. Cancellation and refund

Who it is for

  • An importer or distributor of hardware or software with digital elements placed on the EU market.
  • A reseller or integrator who has to show due diligence on the products it passes on, from 11 December 2027.
  • A company that is both a manufacturer and a distributor of others' products, for the second role.

Who it is not for

  • A manufacturer: the technical file pack carries your duties, not this one.
  • A company that only uses products with digital elements internally.
  • A team that wants the register kept as its suppliers change: that is the workspace's job.

How delivery works

  1. 1. Pay

    Paddle takes the payment in the overlay on this page and issues the invoice, VAT handled for your country.

  2. 2. Receive

    Within minutes an email carries a link, good for 30 days, to the set as PDF and DOCX.

  3. 3. Use, or claim

    Edit the DOCX yourself, or create a free workspace with the same email: the purchase attaches to it and the documents are drafted again from your own product record.

Questions

What is the difference between an importer and a distributor here?
An importer places a product from outside the EU on the market and carries Article 19; a distributor makes it available on the market and carries Article 20. The role determination in the pack decides which you are, per product line.
Do I need an account to buy it?
No. Paddle takes the payment on this page and the documents arrive by email. A free workspace can claim the purchase later if you want the register kept live.
Is one pack enough for several product lines?
Yes. The duties are on the organisation; the register lists every product line, and the manufacturer request is sent per manufacturer.
In which language are the documents?
English, and every document is DOCX as well as PDF so it can be translated: on a reasoned request a market surveillance authority can ask for the documentation in a language that authority easily understands. The page and the support are in yours.
What does the workspace add?
The register as live records per supplier, the requests tracked to an answer, the non-conformity procedure as a task with its dates, and an export with the audit trail.

The other path

€249 a month runs the same file live: register the product, the workspace drafts every document from its record, keeps the clocks and stays current.

Open the workspace

This page in:DeutschFrançaisNederlandsEspañolDansk