Article 3(13) is the white-label test
Article 3(13) defines a manufacturer as the natural or legal person who develops or manufactures products with digital elements, or has products with digital elements designed, developed or manufactured, and markets them under its name or trademark — whether for payment, monetisation or free of charge. The second limb is the private-label catch: commissioning an OEM or ODM and selling under your brand still makes you the manufacturer. Article 14(1) and 14(3) then say a manufacturer shall notify actively exploited vulnerabilities and severe incidents via the single reporting platform. The factory's CE marks, ISO certificates or "we handle security updates" brochure do not rewrite that definition.
Who files — brand owner vs OEM/ODM
- White-label / private-label brand owner: you place the product on the Union market under your name or trademark → you are the manufacturer → Article 14 is yours.
- OEM/ODM building only for that brand: supplier relationship. Contracts should force fast vulnerability notice so the brand can meet the early-warning window; the ODM does not become the Article 14 filer merely by flashing firmware or holding the SBOM.
- ODM with its own brand line: manufacturer for units marketed under the ODM's name or trademark; supplier for customer-branded units. Track them as separate cases.
- Resale under the original foreign brand (no rebrand): you may be an importer or distributor instead — see importers and distributors. That is a different duty set; it is not an Article 14 filing by you.
Article 21 for importer/distributor rebrands
If you start as an importer or distributor and then place the product under your name or trademark — or substantially modify a product already placed on the market — Article 21 says you shall be considered a manufacturer and subject to Articles 13 and 14. That rule closes the "we only stickered it" loophole. Two cautions: (1) many white-label buyers are already inside Article 3(13) because they had the product manufactured for their brand; (2) how Article 21's own application date interacts with the live Article 14 clocks for a pure rebrand chain is a counsel question — do not assume a logo swap escapes reporting readiness. For non-EU brand owners, also read Article 14 for non-EU manufacturers.
Contracts help the clock; they do not move the filer
Brand owners often need a 12-hour (or shorter) contractual notice from the ODM so the manufacturer still has time to submit the early warning within 24 hours of its awareness. That is operational hygiene, not a transfer of the statutory duty. Likewise, appointing an ENISA SRP Assigned Representative or an Article 18 authorised representative can change who clicks submit or which CSIRT end-point you use — it does not make the ODM the Article 14 obligated party for your brand.
Same Article 14 clocks once you are the manufacturer
From awareness of an actively exploited vulnerability or a severe incident affecting product security: early warning within 24 hours, fuller notification within 72 hours, then the final report (14 days after a corrective or mitigating measure is available for an exploited vulnerability; within one month after the 72-hour notification for a severe incident). Awareness timing is covered in when the clock starts; deadline overview in reporting deadlines explained. Official submission still goes through the ENISA Single Reporting Platform.
Questions people ask
- We buy finished devices from an ODM and put our logo on them. Who files Article 14?
- Usually you. Article 3(13) defines a manufacturer as the person who develops or manufactures products with digital elements, or has them designed, developed or manufactured, and markets them under its name or trademark. Outsourcing the build does not move the duty. Article 14 then says that manufacturer shall notify via the Single Reporting Platform.
- We are the ODM / contract manufacturer. Do we still have to report under Article 14?
- Not for units that only ever reach the Union market under the customer's name or trademark. For those SKUs you are a supplier; the brand owner is the manufacturer. If you also place the same hardware under your own brand on the Union market, you are the manufacturer for that line and Article 14 is yours for those products. Map duty by brand and product family, not by factory site.
- Can a supply contract make the ODM file the ENISA reports for us?
- A contract can require the ODM to tell you fast, hand over SBOMs, and help draft technical facts — that is often essential to hit the 24-hour early warning. It does not rewrite Article 14. The manufacturer named under Article 3(13) remains the obligated party on the Single Reporting Platform unless the legal roles genuinely change.
- We import a foreign brand and then rebrand it for EU retail. Is that the same as white-label?
- Commercially similar; legally check two hooks. If you have the product designed, developed or manufactured and market it under your name, Article 3(13) already points at you as manufacturer. Separately, Article 21 says an importer or distributor that places a product under its own name or trademark (or substantially modifies one already placed) shall be considered a manufacturer and subject to Articles 13 and 14. Confirm with counsel how Article 21's application date interacts with the live Article 14 clocks for your exact chain.
- When did reporting start for white-label brands?
- The same date as for other manufacturers: Article 14 applies from 11 September 2026, including for products already on the Union market. Being an OEM/ODM customer, or having no factory of your own, does not delay that date.
- What should brand owners and ODMs lock down before the next exploited vulnerability?
- Per product family: whose name or trademark is on the Union-market unit; who is the Article 3(13) manufacturer; who holds ENISA SRP access; how the factory notifies the brand inside the early-warning window; and how you timestamp awareness. Then practice the 24h / 72h / final-report chain on the free desk or deadline calculator — filing still goes through ENISA's platform.