the Cyber Resilience Act: what your European distributor will ask you

Your European distributor will ask whether your product is in scope of the Cyber Resilience Act, which conformity route you will use, where your EU declaration of conformity and CE marking will be, what the end date of your support period is, and who receives vulnerability reports. It asks because Regulation (EU) 2024/2847 gives importers and distributors their own legal checks before they may sell your product, with most of them applying from 11 December 2027. A vendor that sends a short readiness pack before the question arrives keeps its place on the distributor’s line card. This guide describes the regulation as of November 2026 and is not legal advice.

a regulation that puts the whole chain to work

The Cyber Resilience Act is a regulation. It does not wait for national transposition: Article 71 says it is binding in its entirety and directly applicable in all Member States. That makes it different from NIS2, which binds member states and reaches companies as transposed into national law. NIS2 makes supplier security a duty of your customer, as covered in NIS2 in the sales conversation. The CRA regulates your product.

It also names every link in the chain. The manufacturer carries the heaviest load in Articles 13 and 14: essential requirements, conformity assessment, technical documentation, vulnerability handling, reporting. But Article 19 tells importers to place on the market only products that comply, and to check before they do. Article 20 tells distributors to “act with due care” and to check the CE marking and the manufacturer’s documents before making a product available.

Two definitions in Article 3 matter for a non-EU vendor. An importer is a person established in the EU who places on the market a product bearing the name or trademark of someone established outside the EU. A distributor is anyone else in the supply chain, other than the manufacturer or importer, who makes the product available without affecting its properties. So the European distributor you signed may legally be your importer, and its resellers are distributors. Which role each partner holds depends on who first supplies the product on the EU market; ask counsel to map your own route.

Who checks what under Articles 13, 19 and 20

1. link 1manufacturer (you)Conformity assessment, CE marking, declaration, support period, vulnerability handling, reporting.
2. link 2importerChecks assessment, documentation, CE marking, user information; adds its own contact details.
3. link 3distributorDue care; verifies CE marking and that documents were supplied.
4. link 4resellerAlso a distributor under the regulation, with the same checks.
5. link 5customerSees the support end date at purchase and a contact for vulnerability reports.

the dates, as of November 2026

The regulation entered into force on 10 December 2024, according to the European Commission. Article 71(2) then staggers application:

• 11 June 2026: Chapter IV, Articles 35 to 51, on notifying conformity assessment bodies, applies. Member states designate the authorities that notify the bodies which will assess higher-risk products.
• 11 September 2026: Article 14 applies. Manufacturers must report actively exploited vulnerabilities and severe incidents through the single reporting platform. ENISA states that it deployed the initial operating capability of that platform on 11 September 2026.
• 11 December 2027: everything else applies, including the essential requirements, conformity assessment, CE marking, and the obligations of importers and distributors in Articles 19 and 20.

Cyber Resilience Act milestones

10 December 2024Entry into force

11 June 2026Rules on notifying conformity assessment bodies apply

11 September 2026Reporting of actively exploited vulnerabilities and severe incidents applies

as of November 2026

11 December 2027All other obligations apply, including importer and distributor checks

Two transition rules shape the distributor’s questions. Under Article 69(2), products placed on the market before 11 December 2027 are subject to the requirements only if they are substantially modified from that date. Under Article 69(3), reporting applies to them anyway. The Commission FAQ adds that the rule works per unit: a non-compliant product type cannot keep being placed on the market after December 2027, and distributors need not bring older units into compliance unless they modify them. For software sold by subscription, ask counsel how that applies to each new licence you sell after December 2027.

The reporting clock is short. Article 14 asks for an early warning within 24 hours of becoming aware of an actively exploited vulnerability, a notification within 72 hours, and a final report no later than 14 days after a fix or mitigation is available.

is your product in scope

The regulation covers products with digital elements whose intended purpose or reasonably foreseeable use includes a data connection to a device or network. Most security software qualifies. The scope questions a distributor will raise are narrower.

SaaS. The Commission guidance of July 2026 says a web application accessed only through a browser is not a product with digital elements, unless it supports the functionality of one. Software supplied to the customer and executed on their side is. If you sell an agent, a sensor or a desktop console that relies on your cloud to perform one of its functions, that cloud part counts as remote data processing under Article 3(2) and belongs to the product. A pure browser-based service may be out of scope; an agent with a cloud back end is in.

Other EU rules. The Commission FAQ lists exclusions for products covered by the medical device, in vitro diagnostic, motor vehicle type-approval, civil aviation and marine equipment rules. These rarely apply to an enterprise security vendor.

Open source. The regulation creates a separate role, the open-source software steward, for legal persons that support free and open-source software intended for commercial activities without placing it on the market. If you sell a commercial product built on an open-source core, you are the manufacturer of what you sell.

Important products. Annex III lists categories that need a stricter route. Class I includes identity management and privileged access management, password managers, anti-malware software, VPN products, network management systems and SIEM systems. Class II includes firewalls and intrusion detection and prevention systems. Under Article 32, a Class I product may use self-assessment only when the manufacturer fully applies a harmonised standard, a common specification or a European cybersecurity certification scheme; otherwise a notified body is involved. A Class II product needs a notified body, through EU-type examination or full quality assurance, or a certification scheme at assurance level at least substantial. Your conformity route therefore depends on your category and on which harmonised standards exist when you assess, so check their status in the Official Journal when you plan.

the questions your distributor will ask

Each question below traces back to a check the importer or distributor must be able to show. Article 19(2) says importers must be able to provide documents proving they made their checks.

The question	What it rests on	What to send
Is the product in scope, and which category?	Article 2, Annex III and IV	A one-page scope assessment, signed off by someone accountable
Which conformity route will you use?	Articles 19(2)(a), 32	The route, the standard or notified body, and the target date
Where is the CE marking and the declaration?	Articles 13(20), 19(2)(c), 20(2)(a), 30	For software, the URL where the CE marking and declaration will sit
What is the end of the support period?	Articles 13(8), 13(19), Annex II	Month and year per product version, and how customers see it
Who receives vulnerability reports?	Article 13(17), Annex II	Your single point of contact and disclosure policy URL
Do you have an SBOM?	Annex I, Part II(1); Annex VII	Confirmation that one exists, and who may see it
Where do your importer’s details go?	Article 19(4)	A place for its name and contact in the user documentation

On SBOMs, be precise. Annex I requires the manufacturer to draw up a software bill of materials covering at least top-level dependencies. Annex VII puts it in the technical documentation, to be given to a market surveillance authority on reasoned request. Annex II makes sharing it with users your choice. A distributor may ask to see it; you are not obliged to hand it over, and you can say so.

On support periods, Article 13(8) sets at least five years unless the product is expected to be in use for less. The Commission FAQ gives subscription antivirus as an example where the support period may match the active subscription. Many security vendors sell by subscription, so get a legal view on how your licence model maps to that example before you publish an end date.

The same evidence often ends up in your customers’ supplier reviews, so build it once and reuse it, as with the material in running the security review in parallel with a POC.

when your distributor becomes the manufacturer

Article 21 turns an importer or distributor into the manufacturer, with the obligations of Articles 13 and 14, in two cases: when it places the product on the market under its own name or trademark, or when it carries out a substantial modification of a product already on the market. The Commission guidance defines substantial modification by Article 3(30): a change after placing on the market that affects compliance with the essential requirements or changes the intended purpose.

That has commercial consequences. A white-label deal, where a distributor or MSSP sells your product under its own brand, moves the full manufacturer burden onto the partner. Expect partners to price that in, ask for indemnities, or refuse. Bundles and custom builds raise the same question. Decide which of those models you will support before you are in the room, and state it in your partner agreement.

Reporting also runs through your partners. Under Article 14(7), a manufacturer without a main establishment in the EU reports to the CSIRT of the member state where its authorised representative sits; failing that, its main importer; then its main distributor; then where most of its users are. Importers and distributors must also tell you about any vulnerability they become aware of, without undue delay, under Articles 19(5) and 20(4). Agree with each distributor how those reports reach your single point of contact.

the readiness pack

A distributor deciding whether to add or keep your line weighs demand, margin, effort and risk, as described in what a partner needs to hear before it adds your line. Regulatory risk now sits in that list. A pack that answers the table above lowers the effort and the risk at once. It also makes the choice of partner simpler: with one distributor per country, there is one importer to brief, one set of contact details in your documentation and one reporting route to agree.

Keep the claims in it narrow. Say what you have done and by when. Never tell a partner the product “makes customers compliant”; the regulation creates obligations for you, and your customers still answer for their own.

the next distributor review

Open the review with your readiness pack instead of waiting for the questionnaire. Then ask the distributor one question: “Which of these checks will you run on our line, and who on your side signs off?” The answer tells you which documents to send, who reads them, and how much time you have before December 2027.