Skip to content
CRA Reporting Desk

CRA Article 14 for importers and distributors: who actually reports

Article 14 of the Cyber Resilience Act is titled "Reporting obligations of manufacturers" for a reason — the 24-hour early warning, 72-hour notification, and final report all run from the manufacturer to ENISA and a coordinating CSIRT through the Single Reporting Platform. If you import or distribute someone else's connected product in the EU, that specific chain isn't yours to file. What you do have is a separate, narrower duty under Articles 19 and 20: tell the manufacturer, and in some cases tell a market surveillance authority directly. Here's exactly where that duty starts and stops.

The short version

  • You don't file on the Single Reporting Platform. That channel, and the 24h/72h/final-report clocks, belong to the manufacturer under Article 14. Importers and distributors aren't users of it.
  • You do have to tell the manufacturer. Article 19(5) (importers) and Article 20(4) (distributors): on becoming aware of a vulnerability, inform the manufacturer without undue delay.
  • Significant risk is a second, separate trigger. If the product poses a significant cybersecurity risk, you immediately inform the market surveillance authorities of every Member State where you made the product available — on top of, not instead of, telling the manufacturer.
  • Manufacturer unreachable or defunct? Article 19(8) / Article 20(6) make it your job to tell the market surveillance authorities yourself, and to tell users where possible.
  • If you're also the manufacturer of your own products, the real Article 14 clocks still apply to those — this page is about what changes when you're acting as importer or distributor for someone else's product.
If you're the manufacturer, open the free CRA Reporting DeskCheck your Article 14 deadlines

Article 14 is a manufacturer-only channel

The Single Reporting Platform, the 24-hour early warning, the 72-hour notification and the final report are all built around one notifying party: the manufacturer, routed to the CSIRT of its main EU establishment (or a fallback order ending in the importer or distributor handling the most product, if the manufacturer has no EU presence — see which CSIRT applies). Appearing in that fallback routing order doesn't give an importer or distributor its own notification to file; it just determines which CSIRT receives the manufacturer's notification. Third-country manufacturers who own that filing: Article 14 for non-EU manufacturers.

What Article 19 actually asks of importers

Under Article 19(5), once an importer becomes aware of a vulnerability in a product it has placed on the market, it must inform the manufacturer without undue delay. Separately, under the same paragraph, if the product presents a significant cybersecurity risk, the importer must immediately inform the market surveillance authorities of each Member State where it made the product available, with details of the non-compliance and any corrective measures already taken. Article 19(3) adds a pre-market version of the same logic: if you have reason to believe a product or the manufacturer's conformity processes don't meet the Regulation, you can't place it on the market until that's fixed, and a significant risk means informing both the manufacturer and the market surveillance authorities.

What Article 20 asks of distributors

Article 20(4) mirrors this for distributors: inform the manufacturer without undue delay on becoming aware of a vulnerability, and separately, immediately inform the market surveillance authorities of the Member States where you made the product available if there's a significant cybersecurity risk. Article 20(3) carries the same pre-market conformity check as the importer version, and Article 20(5) adds that on a reasoned request, you must give a market surveillance authority the conformity information it asks for and cooperate on measures to address the risk.

If the manufacturer can't act

Article 19(8) and Article 20(6) exist for the case where the chain upstream breaks: if you learn the manufacturer has stopped operating and can't meet its own CRA obligations, you must inform the relevant market surveillance authorities without undue delay, and inform users of the affected products where that's possible. That duty sits with you, not with a report you'd otherwise have expected the manufacturer to file.

Wearing both hats

Plenty of companies are a manufacturer for some products and an importer or distributor for others — white-label hardware, OEM boards, bundled devices. The two duties don't merge. If you put your own brand on a product someone else built, you may already be the manufacturer — see white-label and OEM/ODM. For products you manufacture, the full Article 14 chain applies and the deadline calculator and free desk are built for exactly that. For products you only import or distribute, your job is to get the vulnerability to the manufacturer fast and in writing, and separately flag significant risk to the right market surveillance authority — not to replicate the manufacturer's own notification.

Keep a record either way

Even though you're not filing on the Single Reporting Platform, informing a manufacturer "without undue delay" is itself a timed obligation you may need to evidence later — what you found, when you told the manufacturer, how, and what they said back. If you're the manufacturer on the receiving end of that notice, it's exactly the kind of fact the evidence log is for, since it feeds your own awareness date for the Article 14 clocks.

Questions people ask

Do importers have to file a CRA Article 14 report with ENISA?
No. Article 14 is titled "Reporting obligations of manufacturers" and only the manufacturer submits through ENISA's Single Reporting Platform. Under Article 19(5), an importer who becomes aware of a vulnerability must inform the manufacturer without undue delay. If the product presents a significant cybersecurity risk, the importer separately and immediately informs the market surveillance authorities of each Member State where it made the product available — still not ENISA or a CSIRT.
Do distributors have to file a CRA Article 14 report with ENISA?
No, for the same reason. Article 20(4) gives distributors the same two-track duty as importers: tell the manufacturer about the vulnerability without undue delay, and, separately, if there is a significant cybersecurity risk, immediately inform the market surveillance authorities in the Member States where the product was made available. Neither duty runs through the Article 14 reporting chain or the Single Reporting Platform.
What if the manufacturer doesn't act on what we told them?
Article 19(3) (importers) and Article 20(3) (distributors) say that if you have reason to believe a product or the manufacturer's processes don't conform to the Regulation, you must not place or make the product available until that's fixed — and if there's a significant cybersecurity risk, you inform the manufacturer and the market surveillance authorities, not just the manufacturer alone. Passing on the vulnerability once doesn't close out your own obligation if the risk is significant and nothing happens.
What if the manufacturer has gone out of business or is unreachable?
Article 19(8) (importers) and Article 20(6) (distributors) cover this directly: if you learn the manufacturer has ceased operating and can no longer meet its CRA obligations, you must inform the relevant market surveillance authorities without undue delay, and, as far as possible, the users of the affected products.
We're both an importer and the EU contact point for a non-EU manufacturer — does that change anything?
It can change which CSIRT the manufacturer's own Article 14 notification routes through — the fallback order in Article 14(7) runs authorised representative, then importer, then distributor, then user base, by whoever handles the most products. That's about where the manufacturer's report lands, not a separate reporting duty of your own. See which CSIRT applies and why on the CSIRT guide.
We're a manufacturer who also imports or distributes our own hardware — which duty applies to us?
Both, depending on which role you're acting in for a given product. If you manufactured it, your 24-hour/72-hour/final-report chain under Article 14 applies regardless of who imports or distributes it. If you're also the importer of record for someone else's product, the Article 19 duty to flag vulnerabilities to that manufacturer runs alongside your own Article 14 duty for your own products — track them as separate cases.

If you're the manufacturer, open the free CRA Reporting Desk

Importing or distributing someone else's product doesn't put you on the Article 14 clocks — but manufacturing your own products does. Track the 24-hour, 72-hour and final report deadlines in the free desk, or check a single case on the calculator. No sign-up; your data stays in your browser. Official filing still goes through ENISA's Single Reporting Platform.

If you're the manufacturer, open the free CRA Reporting DeskCheck your Article 14 deadlines

Workflow support, not legal advice. Whether you are acting as manufacturer, importer or distributor for a given product, and what that means for your obligations, is a legal and factual determination for qualified counsel. Article 19/20 detail above is cross-checked across independent secondary sources citing Regulation (EU) 2024/2847; EUR-Lex direct fetch was unavailable at draft time — confirm against the Official Journal text (EUR-Lex) before relying on this for a live case.