InsideCRA
InsideCRA › Articles › Article 22

Regulation (EU) 2024/2847 · Chapter

Article 22 — Other cases in which obligations of manufacturers apply

The role-shifting article: when someone else's obligations become yours.

LAW Official text — verbatim from the Official Journal snapshot; only the Official Journal is authentic.

1.1. A natural or legal person, other than the manufacturer, the importer or the distributor, that carries out a substantial modification of a product with digital elements and makes that product available on the market, shall be considered to be a manufacturer for the purposes of this Regulation.

2.2. The person referred to in paragraph 1 of this Article shall be subject to the obligations set out in Articles 13 and 14 for the part of the product with digital elements that is affected by the substantial modification or, if the substantial modification has an impact on the cybersecurity of the product with digital elements as a whole, for the entire product.

BINDING Source: Regulation (EU) 2024/2847 (Cyber Resilience Act) · publisher European Union · captured 2026-09-16 · snapshot sha256:27b7c6c64c773001… · CELEX 32024R2847

What this article does

Article 22 covers a person other than the manufacturer, importer or distributor who substantially modifies a product and makes it available on the market: that person is considered a manufacturer F-014, subject to Articles 13 and 14 for the part affected by the modification, or for the entire product where the modification affects the cybersecurity of the product as a whole. The integration corollary points the same direction: a developer who builds a product out of components is the manufacturer of the resulting product F-104.

The scenario to watch

Agencies and integrators trip on this one. A substantial modification can feel like customisation; under this Regulation it makes you a manufacturer for the modified part, or for the whole product F-014. Rebranding reaches the manufacturer role by a different route, through the manufacturer definition and Article 21 F-106.

Verified facts this page relies on

Facts are maintained and human-verified in the CEMarque Facts Table (v2026.09.4, verified 2026-09-10).

Editorial review: Claude (AI reviewer, delegated by the editor), 2026-10-08. Methodology and correction process: how this site works.

Related in the reference

Not sure whether this applies to your product? Check if the CRA applies to you on CRARequired.