According to section II of the proposed CRA the regulation will apply to so-called economic operators such as manufacturers, authorised representatives, importers and distributors of products with digital elements.

The reason for that is the EU Commission’s objective to set up obligations for economic operators in relation to the placement on the market of products with digital elements, as adequate for their role and responsibilities on the supply chain. The majority of the obligations are imposed on the manufacturer since he significantly controls the development of the product with digital elements, determines its characteristics and can thus influence the inherent cybersecurity risks.

The manufacturer is defined in Art. 3 point (18) of the proposed CRA as “any natural or legal person who develops or manufactures products with digital elements or has products with digital elements designed, developed or manufactured, and markets them under his or her name or trademark, whether for payment or free of charge.”  Therefore, not only the commissioned product developer but also the client is covered by the definition.

Pursuant to Art. 12 (3) of the proposed CRA, the manufacturer may appoint an authorised representative (see Art. 3 point (19) of the proposed CRA) for the performance of tasks, such as the cooperation with the market surveillance authorities. In particular, the manufacturer will make use of this possibility if he is located outside the EU and also does not operate an establishment in the Union, so that the authorised representative can perform the communication with the market surveillance authorities on his behalf.

The regulation also sets up obligations for the importer who is defined in Art. 3 point (20) of the proposed CRA as “any natural or legal person established in the Union who places on the market a product with digital elements that bears the name or trademark of a natural or legal person established outside the Union.” The term “placing on the market” means “the first making available of a product with digital elements on the Union market” whereas “making available on the market” is defined as “any supply of a product with digital elements for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge.” In this respect, the person of the importer becomes relevant if the importer purchases a product with digital elements from a manufacturer located outside the EU and imports it into the Union.

The proposed CRA also imposes obligations on distributors that are defined in Art. 3 point (21) of the proposed CRA as “any natural or legal person in the supply chain, other than the manufacturer or the importer, that makes a product with digital elements available on the Union market without affecting its properties.” This includes companies that sell products with digital elements to end customers. In this context, the regulation does not distinguish between B2B or B2C users of products with digital elements. This is mainly because it is not necessary in view of the purpose of the regulation to increase cybersecurity and to enable users to use such products in a secure manner. After all, both companies and consumers come into contact with the products covered by the regulation in equal measure (see recital 1 and 2 of the proposed CRA).

Practical recommendations:

Due to the exact definitions of the economic operators that are addressed by the CRA, we recommend checking at an early stage whether companies fall within the scope of this regulation since it imposes different obligations so that the measures to be undertaken vary from addressee to addressee. In addition, the ongoing legislative process should be followed with regard to possible adjustments in the personal scope of application because changes to the draft regulation are still to be expected.

In our CRA-Update series, we regularly present information on the proposed Cyber Resilience Act and keep you informed about changes in the ongoing legislative process. In each of our articles, we give you a brief overview of a specific topic, presenting the most important aspects and practical implications.