Yes. The EU Cyber Resilience Act (CRA) applies to any company that places a product with digital elements on the EU market, wherever that company is based. A US manufacturer selling connected devices, desktop or on-premises software, mobile apps or firmware to EU customers has the same obligations as a manufacturer in Germany or the Netherlands. The reporting obligations have applied since 11 September 2026. Everything else applies from 11 December 2027.
This article explains who counts as a manufacturer, when your product is on the EU market, what’s in and out of scope, and what your EU importers and distributors will ask of you. It also corrects a claim that comes up in many search results: that every non-EU manufacturer must appoint an EU authorised representative.
Who counts as a manufacturer under the CRA?
You’re the manufacturer if you develop or manufacture a product with digital elements, or have it developed or manufactured, and market it under your own name or trademark (Article 3, point 13). That’s true whether you charge for the product, monetize it in another way or give it away as part of a commercial activity.
A product with digital elements is software or hardware together with its remote data processing solutions (Article 3, point 1). Components sold separately count too, so a US company selling an SDK, a firmware module or a software library to EU device makers is also a manufacturer.
When is your product on the EU market?
Your product is on the EU market as soon as you offer it to EU customers, including online. For software, the Commission’s guidance says a version is placed on the market at the moment of its first offering for distribution or use; later downloads of the same version are making it available (guidance points 13 and 14).
Online sales count when the offer targets EU users. Regulation (EU) 2019/1020, which governs market surveillance for the CRA, says a product offered online “shall be deemed to be made available on the market if the offer is targeted at end users in the Union” (Article 6). Shipping to EU countries, an EU-language storefront or prices in euros are typical signs of targeting.
Selling only through EU resellers doesn’t take you out of scope. The product still carries your name, so you remain the manufacturer, and your resellers take on their own duties as importers and distributors (see below).
Is your product in scope?
Most products a US technology company sells to EU customers are in scope. The main exception is software that runs entirely on your servers and is only accessed through a browser.
| What you sell | In scope? | Why |
|---|---|---|
| Connected hardware: routers, cameras, industrial controllers, wearables | Yes | Hardware with digital elements, including its firmware |
| Desktop or on-premises software, installed by the customer | Yes | Software product placed on the market |
| Mobile apps, desktop clients and agents shipped with a SaaS service | Yes | Software the user installs |
| Cloud backend a device or app needs to work | Yes, as part of that product | Remote data processing (Article 3, point 2; recital 12) |
| Web application used only through a browser | No | The Commission's guidance says such an application "is not a product with digital elements" (point 21, Example 5). NIS2 may apply to the service instead. |
| Components and libraries sold to EU device makers | Yes | Components placed on the market separately are products with digital elements |
Some product types are excluded because other EU laws already cover them, such as medical devices, motor vehicles and civil aviation equipment (Article 2). Our CRA guide for SMBs covers scope and the four product classes in more detail.
What do non-EU manufacturers have to do?
The obligations are identical to those for EU manufacturers. Before you place a product on the EU market from 11 December 2027, you must:
- Design and build it to meet the essential cybersecurity requirements in Annex I, Part I, based on a documented cybersecurity risk assessment.
- Have vulnerability handling processes that meet Annex I, Part II, including an SBOM covering at least the top-level dependencies.
- Carry out the conformity assessment for your product class: internal control (module A) for default products, harmonised standards or a notified body for important class I, a notified body or EU certification for class II and critical products.
- Draw up technical documentation and an EU declaration of conformity, and affix the CE marking.
- Set a support period that reflects how long the product is expected to be in use, at least five years unless the expected use is shorter, and provide free security updates throughout it (Article 13(8)). The Commission’s guidance stresses that five years is a minimum, not a default (point 126).
- Keep the technical documentation and declaration of conformity available to EU market surveillance authorities for at least 10 years, or for the support period if that’s longer.
The reporting obligations in Article 14 already apply, and they cover products you placed on the EU market before December 2027 as well.
Do you need an EU authorised representative?
Not under the CRA itself. Article 18(1) says a manufacturer “may, by a written mandate, appoint an authorised representative”. It’s an option, not an obligation. Whether you need an EU-based operator depends on the other EU product laws that apply to your product.
Regulation (EU) 2019/1020, Article 4, says certain products can only be placed on the EU market if an economic operator established in the EU is responsible for them: an EU manufacturer, an importer, an authorised representative or a fulfillment service provider. That rule applies only to products covered by the laws listed in Article 4(5), which include the Radio Equipment Directive, the EMC Directive and the Low Voltage Directive. Most connected hardware falls under at least one of them. Software sold on its own does not.
| Your situation | EU-based operator required? |
|---|---|
| Software only, sold directly to EU customers online | Not by the CRA or by Regulation 2019/1020, Article 4 |
| Connected hardware under the Radio Equipment, EMC or Low Voltage Directive | Yes: an importer, an authorised representative or a fulfillment service provider in the EU |
| Any product sold through an EU importer | The importer already has CRA duties of its own (Article 19) |
A representative can still be worth having for software. It gives authorities and customers a contact in the EU, and it decides where you report incidents if you have no EU establishment (see the reporting section). If you appoint one, the mandate must at least let them keep your declaration of conformity and technical documentation available for 10 years, hand documentation to authorities on request and cooperate on corrective action (Article 18(3)). Your core obligations, such as designing to Annex I and handling vulnerabilities, can’t be delegated to them (Article 18(2)).
What will your EU importers and distributors ask for?
An importer is the EU company that first places your product on the EU market. Before doing so, it must check that you’ve carried out the conformity assessment, drawn up the technical documentation, affixed the CE marking, supplied the declaration of conformity and user information, and met the related labeling and information duties (Article 19(2)). It must keep a copy of your declaration of conformity for 10 years, tell you about vulnerabilities it learns of, and inform authorities if you stop operating (Article 19(7), (8) and (10)).
In practice, expect your EU partners to ask for the declaration of conformity, access to the technical documentation, your support period, your vulnerability disclosure contact and proof that you can report on time. Many will write these into contracts well before December 2027.
An importer or distributor that sells your product under its own brand, or substantially modifies it, becomes the manufacturer and takes on your obligations for that product (Article 21). This matters for white-label and OEM deals: decide in the contract who is the manufacturer.
How does vulnerability reporting work from outside the EU?
You report actively exploited vulnerabilities and severe incidents through ENISA’s single reporting platform, to the CSIRT designated as coordinator in one member state. Without an EU establishment, Article 14(7) picks that member state in this order:
- Where your authorised representative for the most products is established
- Otherwise, where the importer placing the most of your products on the market is established
- Otherwise, where the distributor making the most of your products available is established
- Otherwise, where most of your users are
The deadlines are the same for everyone: an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report within 14 days after a fix is available, or within one month for a severe incident (Article 14). For a US team, the 24-hour clock means someone must be able to triage and file at any hour, including during the European working day.
Timeline for non-EU manufacturers
| Date | What applies |
|---|---|
| 11 September 2026 | Reporting of actively exploited vulnerabilities and severe incidents (Article 14), including for products already on the market |
| 11 December 2027 | All other obligations. Products placed on the EU market from this date must fully comply. |
Penalties for breaching the essential requirements or manufacturer obligations reach €15 million or 2.5% of worldwide annual turnover, whichever is higher (Article 64(2)), and authorities can order products off the EU market.
Where should a non-EU manufacturer start?
- List what you sell into the EU and mark each product in or out of scope using the table above.
- Classify each product: default, important class I, important class II or critical. The class decides whether you need a notified body, and notified body capacity is limited.
- Choose your EU route for each product: direct sales, importers and distributors, an authorised representative, or a mix. Check whether the Radio Equipment, EMC or Low Voltage Directive makes an EU-based operator mandatory.
- Make reporting work now: a 24-hour triage process, a named CSIRT, and a vulnerability disclosure policy with a public contact.
- Plan the conformity work backward from December 2027: risk assessment, Annex I gap analysis, SBOM and vulnerability handling, technical documentation.
Our overview of the CRA harmonised standards shows which standards will help with step 5 and how far each one is.
Frequently asked questions
Does the CRA apply if we have no office or employees in the EU?
Yes. What matters is that your product is placed on the EU market, not where your company is established. Without an EU establishment you have no main establishment there, which changes where you report (Article 14(7)) but not what you must do.
We only sell through EU resellers. Are we still the manufacturer?
Yes, as long as the product is sold under your name or trademark. The reseller has its own duties as importer or distributor and will check your documentation. It only becomes the manufacturer if it rebrands the product or substantially modifies it (Article 21).
Is our SaaS product covered by the CRA?
A web application used only through a browser is not a product with digital elements, according to the Commission’s July 2026 guidance. Apps, clients and agents your customers install are, and so is a cloud backend that one of your products needs to work.
Does compliance with NIST SSDF or IEC 62443 count?
It helps as evidence, but it doesn’t give a presumption of conformity. Only harmonised standards cited in the Official Journal, common specifications and EU cybersecurity certification do that. A mature US secure development program usually covers much of Annex I, Part II, but you’ll still need a CRA risk assessment, technical documentation mapped to Annex I and an EU declaration of conformity.
Do we have to appoint an EU authorised representative?
Not under the CRA; Article 18 makes it optional. Connected hardware covered by the Radio Equipment, EMC or Low Voltage Directive needs an EU-based economic operator under Regulation 2019/1020, Article 4, which can be an importer or an authorised representative.
How we help non-EU manufacturers
We work with manufacturers outside the EU remotely and schedule workshops to fit US time zones. The EU CRA Compliance Journey takes a product from reporting readiness to CE conformity in seven work packages, and the EU CRA Internal Audit gives you a list of non-conformities in a few days. To check where you stand, take the free EU CRA Self Assessment or book a free EU CRA strategy call.
Sources: Regulation (EU) 2024/2847, the Cyber Resilience Act, Articles 2, 3, 13, 14, 18, 19, 21 and 64; Regulation (EU) 2019/1020 on market surveillance, Articles 4 and 6; European Commission, Commission guidance on the application of the Cyber Resilience Act, C(2026) 5252, 27 July 2026, points 13, 14, 21 and 126.