CRA manufacturer obligations

CRA manufacturer duties sit in Chapter II, especially Articles 13 and 14

Direct answer. Under Regulation (EU) 2024/2847, Chapter II sets obligations of economic operators. Article 13 is “Obligations of manufacturers”: when placing a product with digital elements on the market, the manufacturer ensures it has been designed, developed and produced in accordance with the essential cybersecurity requirements in Part I of Annex I, and handles vulnerabilities in accordance with Part II of Annex I. Article 14 is “Reporting obligations of manufacturers”, covering actively exploited vulnerabilities and severe incidents. Importers, distributors, and authorised representatives have their own articles later in that chapter. Application dates are Article 71, walked on the CRA timeline, not repeated here. Read Regulation (EU) 2024/2847 on EUR-Lex. This page is not legal advice.

CRALedger Duty Records (Shopify App Store · Write a review) tracks product roles, checklists and open record gaps, Article 14 deadlines, and draft reporting packs. It does not file notifications on ENISA’s platform and it does not decide whether you are the manufacturer. This page points at the manufacturer articles — not the clock hours and not a role determination.

Related: EUDR Records Manager — DDS reference numbers on supplier lots.

Free check first: CRA role and scope self-check runs in your browser and sends nothing. Describe a product and your role and see which articles of Regulation (EU) 2024/2847 to read.

Checklist: manufacturer articles before a duty file

• Read Chapter II on EUR-Lex, starting with Article 13 and Article 14, not this paraphrase.
• For conformity, follow Article 13 to Annex I Part I. For vulnerability handling, follow Article 13 to Annex I Part II. Do not treat this page as the annex.
• For reporting, open Article 14. The hour-by-hour clocks are on CRA Article 14 incident deadlines.
• If you are not the manufacturer, read the article for that operator (Articles 18 to 22) before you apply Article 13.
• For when those articles apply, use the CRA timeline and confirm Article 71 on EUR-Lex.

Article 13: conformity and vulnerability handling

Article 13 is titled “Obligations of manufacturers”. Its opening duty is that, when placing a product with digital elements on the market, manufacturers shall ensure that it has been designed, developed and produced in accordance with the essential cybersecurity requirements set out in Part I of Annex I. Later paragraphs of the same article send vulnerability handling to Part II of Annex I, including handling vulnerabilities of the product for the support period and policies for vulnerabilities reported from internal or external sources. The article is long. This page does not restate every paragraph. The record-keeping side of that duty file is CRA duty records.

Article 14: reporting

Article 14 is titled “Reporting obligations of manufacturers”. It requires the manufacturer to notify an actively exploited vulnerability in the product with digital elements that it becomes aware of, and to notify a severe incident having an impact on the security of the product, through the single reporting platform. The deadlines inside Article 14 are a different page. When Article 14 starts to apply is Article 71, on the CRA timeline.

Manufacturer is not every economic operator

Chapter II continues past the manufacturer. On the EUR-Lex text the later headings include:

• Article 18 — Authorised representatives
• Article 19 — Obligations of importers
• Article 20 — Obligations of distributors
• Article 21 — Cases in which obligations of manufacturers apply to importers and distributors
• Article 22 — Other cases in which obligations of manufacturers apply

Those titles are the map. They are not a summary of each duty. An importer or distributor informing the manufacturer of a vulnerability is not the same act as the manufacturer’s Article 14 notification. That split is CRA vulnerability forwarding vs Article 14.

What this page is not

• Not legal advice, a role determination, or a conformity assessment.
• Not the application dates. That URL is Cyber Resilience Act timeline.
• Not the Article 14 hour clocks. That URL is CRA Article 14 incident deadlines.
• Not a full restatement of Article 13 or Annex I. Read them on EUR-Lex.

Related pages

• CRA role and scope self-check — which articles to open
• Cyber Resilience Act timeline — Article 71 dates
• CRA duty records
• CRA Article 14 incident deadlines
• Regulation (EU) 2024/2847 — Chapter II
• CRALedger Duty Records — live App Store listing
• Shopify apps hub
• Tools

Not legal advice. Confirm Articles 13 and 14, Annex I, and the later economic-operator articles on EUR-Lex before you treat a duty as yours. The app stores records you enter. It does not file the notification.