Role under the Regulation

Manufacturer

The role that carries most of the Regulation's duties.

A manufacturer is anyone who develops or manufactures products with digital elements — or has them designed, developed or manufactured — and markets them under their own name or trademark F-011. Marketing under your own name or trademark makes you the manufacturer even if someone else built the product F-106, and integrating a component into your own product makes you the manufacturer of the result, responsible for its conformity, component included F-104.

Where the duty set lives

Article 13 is the manufacturer's home article: risk assessment, essential requirements, technical documentation drawn up before placing on the market and kept for at least ten years with the declaration of conformity F-016. Article 14 adds the reporting rhythm — early warning within 24 hours, notification within 72 hours, then the final report F-028. The support period the manufacturer sets — at least five years unless the product is genuinely shorter-lived — frames how long the vulnerability-handling duties run F-015.

The trap

The role is functional, not contractual. White-labelling, rebadging, or "we just resell it under our brand" all land you in this role F-106.

Verified facts this page relies on

F-011 Manufacturer: a natural or legal person who develops or manufactures products with digital elements or has them designed, developed or manufactured, and markets them under their name or trademark, whether for payment, monetisation or free of charge. Art. 3(13)
F-104 A developer who integrates a component into their own product is the manufacturer of that product and responsible for its conformity, including the integrated component. Art. 13(5), Art. 3(13)
F-106 Marketing a product under your own name or trademark makes you the manufacturer even if someone else developed it. Art. 3(13), Art. 21
F-016 Technical documentation (Annex VII) is drawn up before placing on the market and kept, with the EU declaration of conformity, for at least ten years after placing on the market or the support period, whichever is longer. Art. 13(12)–(13), Art. 31
F-028 Actively exploited vulnerability: early warning within 24 hours of awareness; notification within 72 hours; final report within 14 days after a corrective or mitigating measure is available. Art. 14(1)–(2)
F-015 Support period: determined by the manufacturer to reflect the expected use time; at least five years unless the product is expected to be in use for less; the end date (month and year) is stated at purchase. A security update, once issued, remains available for at least ten years or the remainder of the support period, whichever is longer. Art. 13(8), (9), (19)

Facts are maintained and human-verified in the CEMarque Facts Table (v2026.09.4, verified 2026-09-10).

Editorial review: Claude (AI reviewer, delegated by the editor), 2026-10-08. Methodology and correction process: how this site works.

Related in the reference

Not sure whether this applies to your product? Check if the CRA applies to you on CRARequired.