Manufacturer
The manufacturer designs or develops the product, or has it designed, and markets it under its own name or trademark. The manufacturer carries almost the whole load: essential requirements, risk assessment, technical documentation, conformity assessment, CE marking, support period, vulnerability handling, and reporting.
Crucially, you become the manufacturer by branding. If you buy an ODM device from a contract manufacturer and put your logo on it, you are the manufacturer under the CRA — with all the obligations, regardless of who wrote the firmware. Your supply contracts must give you the artefacts you need: source or binaries, SBOM, security patch commitments, and vulnerability notifications.
Importer
An importer places a product from outside the EU on the Union market. Before doing so it must verify that the manufacturer carried out conformity assessment, drew up technical documentation, applied CE marking, and provided the required user information. If an importer knows or has reason to believe the product does not conform, it must not place it on the market — and must inform the manufacturer and market surveillance authorities.
Distributor
A distributor makes a product available on the market without being manufacturer or importer. Its duty is one of due care: check CE marking and the accompanying documentation are present, do not distribute a product it knows to be non-conforming, and ensure storage and transport do not compromise conformity.
When a distributor or importer becomes a manufacturer
Any of these flips you into the manufacturer role, with the full obligation set:
- Placing the product on the market under your own name or trademark.
- Making a substantial modification to a product already on the market.
For white-label embedded hardware this is the single most common compliance surprise.
Open-source software steward
A new role invented by the CRA. A steward is a legal person — typically a foundation — that provides sustained support for the development of FOSS intended for commercial activities, without monetising the software itself. Stewards have a lighter, proportionate regime: a cybersecurity policy, cooperation with market surveillance authorities, and reporting duties for actively exploited vulnerabilities in their software. They are not required to do conformity assessment or CE marking.
Individual contributors to open source are not caught at all. But if you integrate open-source components into a commercial product, you are responsible for their security in your product — exercising due diligence on the components you incorporate is an explicit manufacturer duty.