Our Road to CRA: How you can be a manufacturer under the CRA without building anything?

Date : 28. October 2026

How you can be a manufacturer under the CRA without building anything?

In everyday speech, the manufacturer is whoever builds the thing. The Cyber Resilience Act applies a different measure, and across much of what we make it produces an answer most people don't expect.

In everyday speech, a manufacturer is whoever develops a device, builds it and puts it together. The Cyber Resilience Act reads the word differently. The legal test is whose name or trademark a product is marketed under, and it doesn't take a logo on the housing to meet it. That role is also where the regulation's obligations land: reporting, documentation, vulnerability handling. The reporting obligations under Article 14 CRA have applied since September 11, 2026, including to products that have been in the field for years. What has to be reported is actively exploited vulnerabilities and severe security incidents. Before you can report anything, you need to know whether the duty is yours.

What the law means by manufacturer

The CRA defines its own terms, and they sit in Article 3. It operates within the New Legislative Framework, the common structure of European product law. Under Article 3(13) CRA, a manufacturer is a natural or legal person who develops or manufactures products with digital elements, or has them designed, developed or manufactured, and markets them under its name or trademark. Whether this happens for payment, monetisation or free of charge makes no difference.

So the question turns on marketing under your own name or trademark. A company that builds only to order, and never markets under its own name, is not a manufacturer within this definition. The reverse holds as well: you don't shed your obligations by handing the work to someone else. Article 13 CRA addresses the manufacturer. The European Commission's Blue Guide, which interprets general product law rather than the CRA itself, states the principle explicitly in section 3.1. In contract development, that routinely puts the roles somewhere other than where the parties expect to find them.

On customer-specific devices, the customer is the manufacturer

For a large part of our business, this definition produces an answer people rarely see coming. We develop customer-specific devices, have them built, and keep them serviced across their working life. They reach the market under our customers' names. That makes our customers manufacturers under the CRA, even though the engineering and the building happen here.

None of which lets us off the hook. It divides the roles cleanly. Developing, building and maintaining a device does not move the manufacturer role; it stays with the client. What we answer for in our own work is set out in the contracts. Our own products are a different matter.

And we are manufacturers in our own right

Take the DHSOM family. We market it under our own name, which makes DH electronics the manufacturer of those modules under the CRA. Inside a customer's device, the same modules are components, meaning hardware or software intended for integration into a product with digital elements (Article 3(6) CRA). Because we place these modules on the market individually, and don't only ship them built in, they are also products with digital elements in their own right, under Article 3(1) CRA. A component that only ever reaches the market inside a customer's finished device would not be.

Both roles run in parallel, and they meet at the point of integration. When a customer builds one of our modules into their device, they have to exercise due diligence doing so, as Article 13(5) CRA requires. Whether their device meets the requirements therefore depends in part on what we supply with the module. The same logic continues one step further down the supply chain. Where components carry software or digital elements, whoever produces them is their manufacturer. If that producer sits outside the EU, further roles come into play. Our distributors are established in the Union: when they are the first to place products on the Union market under the producer's trademark, they are importers under Article 3(16) CRA.

What we are still working on

• Customer contracts have often had no explicit provisions on vulnerabilities, updates and support periods. The statutory obligations apply either way, and we are working out the contractual side now.
• Where purchased components come from, and how the roles divide along the supply chain, is something we keep under review.

What this means for our customers

If you place a device on the market, the first thing to settle is whose name or trademark it is marketed under. That is where the manufacturer role sits. The second step is a question for your own suppliers: what evidence and information can we expect from you? Because the CRA doesn't stop at the individual product. It runs the length of the supply chain, from the individual part through the component to the finished device, and every stage carries obligations of its own depending on the role.

We're glad to help work that out. Nobody can take the manufacturer role off your shoulders, ours included, but we can make sure there's no doubt about what comes from us. If you aren't certain where the roles sit for your device, you're welcome to get in touch anytime.