The CRA brings many new responsibilities for manufacturers of products with digital elements. But what about manufacturers that are outside the jurisdiction of the EU? Compliance with the CRA is still enforced via market controls; the manufacturer must place the CE mark on their product for it to be legal to sell in the EU, and make a declaration of conformity supporting that. But the CRA, unlike a lot of other consumer regulation, also imposes obligations on manufacturers for years after the product is sold. If the manufacturer isn’t an EU entity, how are those obligations enforced?
The answer is in Article 19 of the CRA. If the manufacturer isn’t meeting their obligations, it’s ultimately the importer who will bear the consequences and costs of a recall or other remediating action.
To make sure this happens, the CRA enumerates some specific requirements on importers. In particular, the importer must:
- Ensure that the manufacturer has supplied all of the required conformity documentation, including a conformity assessment if the product falls into one of the categories that requires third-party assessment
- Maintain that documentation for at least 10 years, and provide it to the regulatory authorities on request
- Notify the manufacturer of any security issues that the importer becomes aware of
- Cooperate with the authorities on any remediation or enforcement actions related to the elimination of identified cybersecurity risks in the product
Additionally, if the importer becomes aware of any reason that the manufacturer might not continue to be able to meet their ongoing requirements under the CRA, they must notify the regulator. If a product ultimately has to be recalled, it is the importer that will bear the cost.
With these obligations, it becomes clear that under the CRA it pays to work with trusted, established manufacturers. If you import goods from a supplier that ends up going out of business, or isn’t responsive to cybersecurity issues in their product, you could be on the hook for a lot of costs.
As an importer, it’s also important to understand conditions where you might actually be considered a manufacturer, and inherit all of those responsibilities: Learn more.
Get in touch with our experts to learn more