Selling a device under your own name makes you its manufacturer

If you buy a finished connected device from a factory — in Shenzhen or anywhere else — and sell it in the EU under your own brand, the Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) treats you as its manufacturer. Not the factory. That is Article 21. This is a documentation aid, not legal advice.

The rule

Article 21, in one sentence: "An importer or distributor shall be considered to be a manufacturer for the purposes of this Regulation and shall be subject to Articles 13 and 14, where that importer or distributor places a product with digital elements on the market under its name or trademark or carries out a substantial modification of a product with digital elements already placed on the market."

Either trigger is enough on its own: your name or trademark on the product, or a substantial modification. And Article 3(13) already defines a manufacturer as a person who has a product "designed, developed or manufactured, and markets them under its name or trademark" — someone else having built it was never the test.

Article 22 covers anyone who is not the manufacturer, the importer or the distributor: substantially modify a product, make it available on the market, and you are considered its manufacturer too (Article 22(1)). Under Article 22(2) the Article 13 and 14 duties then apply for the part of the product the modification affects, or for the entire product where the modification has an impact on its cybersecurity as a whole.

What that hands you

Every Article 13 and Article 14 duty, as if you had designed the device yourself:

• The Annex I essential requirements, a conformity assessment and an EU declaration of conformity — see "The declaration of conformity for connected devices".
• A support period you choose, justify and publish: long enough to reflect how long the device is expected to be in use, and at least five years unless it is expected to be in use for less (Article 13(8)) — see "What the CRA support period means".
• Vulnerability handling for that whole period: an SBOM, fixes without delay, a disclosure policy, a contact address (Annex I, Part II).
• The Article 14 clocks — 24 hours, 72 hours, final report — in force since 11 September 2026 — see "Article 14, step by step".

Those guides say what each asks for; this one does not repeat them.

"Substantial modification"

Article 3(30): a change to the product following its placing on the market which affects its compliance with the essential cybersecurity requirements set out in Part I of Annex I, or which results in a modification to the intended purpose for which the product has been assessed.

The Commission's guidance on applying the CRA, published on 27 July 2026 as C(2026) 5252, gives its Section 4 to the question. The Commission calls it non-binding and says it applies only once formally adopted, which had not happened by 11 October 2026: what is published is a draft whose content the Commission has approved. We cite it as the Commission's reading, not as law. We read Section 4 in full on 9 October 2026 and checked it again on 11 October 2026.

Section 4 treats a change to the device and a software update separately.

A change to the device itself — a repair, a refurbishment, a different part. Article 3(30) above is the test, applied case by case; Sections 4.1 and 4.2 of the guidance (points 93 to 102) cover it:

• A physical modification made in a repair, refurbishment or maintenance operation is not necessarily a substantial modification. The question in each case is whether it affects the product's compliance with the essential requirements in Part I of Annex I, or changes the intended purpose the cybersecurity risk assessment covered (point 94).
• Replacing a defective or worn part with one that performs better does not in itself make the modification substantial; it does so only if the change affects compliance with the essential requirements or changes the intended purpose in a way the risk assessment did not cover (point 95).
• A replacement part that differs from the original in characteristics relevant to cybersecurity — the guidance names algorithms, protocols, cryptographic mechanisms and access control features — may not count as identical to it (point 100), and a spare part that is not identical is a product with digital elements in its own right, subject to the CRA (point 101).

For any other change to the hardware the guidance has no section of its own, and Article 3(30) is the test.

A software update. Section 4.3 (points 103 to 113) covers it. The guidance says this part is "intended in particular to help manufacturers of software products with digital elements who make changes to their own products" (point 103):

• The assessment of a software update should "not be based on the scale or complexity of the change", but on its potential adverse impact on the product's cybersecurity risk profile (point 107).
• Point 110 is a list of things to consider, not a test to pass: manufacturers "may consider, in a non-exhaustive manner," whether the update introduces new threat vectors, enables new attack scenarios, or changes the likelihood or the potential impact of attack scenarios already identified.
• Risk your own risk assessment already covered does not count: functionality you anticipated, assessed and mitigated is not a substantial modification (points 104 and 106).
• Security updates are generally not substantial modifications, because their purpose is to reduce risk, even where the change is large (point 108) — unless one changes the intended purpose or adds new exposure, such as moving a local function out to a remote service (point 109).

Either kind of change, once it is substantial (Section 4.4): making the modified product available is a new placing on the market (point 116), and whoever made the change and makes it available is its manufacturer, original designer or not (point 117).

How far that reaches. If the change does not weaken the security of the whole product, the Article 13 and 14 duties cover only the part changed, and the original manufacturer still answers for the rest (points 118 and 119). If it does, for example because it is no longer limited to one component, they cover the whole product (point 121). Whose words: for a person who is none of manufacturer, importer or distributor, Article 22(2). For an importer or distributor, Article 21 has no such paragraph; the limit is the draft guidance's reading (point 119), not settled law.

What you may reuse. Existing tests and documentation for what the change did not touch; it is for you to show which those are, and you still draw up the declaration of conformity (footnote 16, quoting the Blue Guide, Section 2.1).

Building a product is not modifying one (point 120). Buy modules and boards, add your own firmware, sell the result under your name, and you are the manufacturer of a new product, answering for all of it; for components that are themselves under the CRA, you may rely on their makers' compliance work. That is the guidance's Example 51. Where your code ends and upstream's begins: "What is yours to document" and "Only what you built".

What the guidance does not do: its Section 4 is about modification throughout, and it adds nothing about putting your own name on an unmodified device. For the own-brand trigger the article text above is all there is.

What to ask the factory for, before you sign (argument)

Our reading, not a rule. Each duty above needs an input only the factory has:

• An SBOM, CycloneDX or SPDX, per firmware version. Annex I, Part II, point 1 makes documenting components yours, and without one you cannot answer "does this CVE affect us?".
• The technical documentation, or a written right of access. It is what you must hold and produce to a market surveillance authority; the factory's word that it exists is not holding it.
• A named security contact and an agreed response time. You owe an early warning within 24 hours of becoming aware of an actively exploited vulnerability. If the fix is theirs to write, their response time is your exposure.
• An update commitment covering your whole support period. What you promise is fixes for the support period you chose and published: at least five years unless the device is expected to be in use for less, and longer where it is expected to be in use for longer (Article 13(8)). Whatever the factory stops short of is yours: if you published seven years and the factory stops at two, the remaining five are yours.

If you only import or distribute

Selling the device unmodified under the maker's own brand is a lighter position. The duties are the importer's or the distributor's.

• Importer (Article 19). Before placing the device on the market, make sure the manufacturer has carried out the conformity assessment and drawn up the technical documentation, and that the device bears the CE marking and comes with the EU declaration of conformity and the user information (Article 19(2)). Put your own name and contact details on the device, its packaging or an accompanying document (Article 19(4)). For at least 10 years after the device was placed on the market, or for the support period, whichever is longer, keep a copy of the declaration and make sure the technical documentation can be made available to a market surveillance authority on request (Article 19(6)).
• Distributor (Article 20). Act with due care (Article 20(1)), and before making the device available verify that it bears the CE marking and that the manufacturer and the importer have met the obligations Article 20(2) lists and handed over all necessary documents.

Both articles ask for more than this, including what to do when you believe a device does not conform. Not the subject of this guide.

What is settled and what is not

Settled (law, in the sources cited): Article 21's two triggers; Article 22 and, for the persons it covers, its part-of-the-product limit; the Article 3(13) and 3(30) definitions; the Article 13(8) support-period rule; and Articles 19 and 20 as cited.

Not settled: whether an importer or distributor who substantially modifies gets the Article 22(2) part-of-the-product limit; Article 21 has no such paragraph.

The Commission's reading, not law: every numbered guidance point. The guidance is published but not yet formally adopted (as of 11 October 2026), and its own point 8 says it is not binding and that only the Court of Justice of the European Union can give an authoritative interpretation of the CRA. We update this guide when it is adopted.

Labelled argument, and nothing else is: the four things to ask the factory for.

How we checked: the guidance was read from the Commission's own PDF on 9 October 2026. Its status was read from the two-page cover communication on 11 October 2026, and points 1 to 8 and Section 4 were compared with this page again the same day. Section 4.4 was read again from the PDF on 14 October 2026. Every article cited here was read in the Official Journal text on EUR-Lex on 11 October 2026 and compared with this page word for word.

This guide does not say that any product, document or firm is compliant, certified, guaranteed or approved. Everything we produce is a draft for your review.