Sellers outside the EU

Selling a connected device into the EU from outside it: the Cyber Resilience Act

You make a connected device outside the EU and sell it to customers or through resellers inside it. You were told the Cyber Resilience Act is a European problem. It is not only that: the duties follow the product onto the EU market, and you are the manufacturer wherever your office is.

The people you sell through have duties of their own. An importer or distributor in the EU may refuse to carry a product without a declaration and a technical file behind it, so they will ask you for those, and for a contact they can send a vulnerability to. You want to know what to have ready before they ask.

Check an SBOM, free

What the Cyber Resilience Act asks of you

Manufacturer duties — the same duties as an EU maker: security by design, vulnerability handling, documentation and a declaration (, source)
Authorised representative — a person in the EU you may appoint, by written mandate, to keep your documents and deal with the authorities for you (, source)
What importers check — an importer is the EU business that first places your product on the EU market, and it must check your paperwork exists. It checks that the conformity assessment was done, the technical documentation drawn up, the product marked, and the declaration of conformity and user information supplied. (, source)
What distributors check — a distributor is a business in the supply chain that is neither the maker nor the importer; it must act with care. It checks that the product carries the marking and that you and the importer have supplied the documents. (, source)
Reporting to ENISA — telling the EU cybersecurity agency about an actively exploited flaw or a severe incident, in three steps, wherever you are based (, source)

“A manufacturer may, by a written mandate, appoint an authorised representative.”
Regulation (EU) 2024/2847, Article 18(1), checked on 2026-10-08, as recorded in legal state 2026.10.13-1.

What Declarable does about it

Asks the scope questions that point to the assessment route your product is likely to need.
Drafts the CRA section of the declaration of conformity that an importer will ask to see.
Prepares drafts of the technical documentation from your product record and SBOM.
Prepares the security contact and disclosure policy that an importer needs to point to.
Counts the Article 14 deadlines from the moment you became aware.

What it does not do

It is not an authorised representative and does not act as yours. Appointing one is your decision, in writing, with a person or business in the EU.
It does not judge whether your product meets the Regulation, and it does not give legal advice.
It does not file reports for you. You submit them yourself on the ENISA platform.

Questions

Am I the manufacturer if my company is outside the EU?: If you design or make the product, or have it designed or made, and sell it under your name, yes: the Regulation calls that a manufacturer, wherever it is based (Article 3(13)). Ask a lawyer about your own set-up.
Do I have to appoint an authorised representative?: The article says a manufacturer may appoint one. Read the sentence quoted above and the Regulation for the tasks a mandate can cover. Whether you need one in practice depends on your supply chain.
What will my EU importer ask me for?: The declaration of conformity, the technical documentation, the user information and a contact for vulnerabilities. Importers have to check that these exist before they place the product on the market (Article 19).
Does the 24-hour reporting duty apply to me?: If your product is in scope and on the EU market, yes, wherever you are based. But it asks something of you only when there is a trigger: an actively exploited vulnerability in the product (Article 14(1)) or a severe incident having an impact on its security (Article 14(3)). From the moment you become aware of one, the early warning is due within 24 hours. The duty has applied since 11 September 2026 (Article 71(2)), to products already on the market too (Article 69(3)).

Check an SBOM, free

What Declarable is, and what it is not

A documentation aid. Declarable prepares drafts and checklists for you to review and edit.
Not legal advice. For a legal question about your product, ask a lawyer.
Not certification. Nobody at Declarable assesses or signs off your product. You sign your own declaration of conformity.
Not an assessment body. Some products need an outside assessment body: an An important product, class I. Self-assessment (module A) is open only if its maker applies in full a harmonised standard, a common specification or a European cybersecurity certification scheme at assurance level “substantial” or higher; otherwise a notified body takes part: modules B and C, or module H (Article 32(2)). Open-source software whose technical documentation is public may self-assess (Article 32(5)). product unless its maker fully applies a harmonised standard or one of the alternatives in Article 32(2), and those on the CRA's Annex III class II and Annex IV lists — the higher-risk product categories, where self-assessment is not enough. Declarable is not one. The scope check asks the questions that point to your category.
Not a filing agent. Declarable does not file reports for you. You submit them yourself on the ENISA platform.

Source for the assessment lists and when an outside body is needed: Annexes III and IV and Article 32 of Regulation (EU) 2024/2847 (Cyber Resilience Act), as recorded in legal state 2026.10.13-1.

Selling a connected device into the EU from outside it: the Cyber Resilience Act