What Article 19 asks importers to verify before a non-EU product reaches the EU market
Article 19 requires an importer to place only compliant products on the EU market, and to confirm before doing so that the manufacturer has carried out the conformity assessment, drawn up the technical documentation, affixed the CE marking and supplied the EU declaration of conformity together with the Annex II user information. The importer does not perform the assessment itself. It must check that the manufacturer did, and it must be able to show what it checked. Before a shipment is released, the practical questions are whether the EU declaration names the product and its version, whether the CE marking is on the product or its packaging, and whether the user information is in the languages the product will be sold in. Ask the manufacturer for the technical documentation or a summary of it, and confirm which conformity assessment module was used and whether a notified body was involved for important or critical products. The importer also carries a separate bar. Under Article 19(3), it must not place a product on the market if it believes the product or the manufacturer's processes do not conform. Where the importer has reason to think a product presents a significant cybersecurity risk, it must inform the manufacturer and the market surveillance authorities. Article 19(4) adds a labeling duty: the importer's name, registered trade name or trademark, postal address and a digital contact must appear on the product, its packaging or an accompanying document. Article 19(5) requires the importer to pass on any vulnerability it becomes aware of to the manufacturer without undue delay.
The difficulty is that the importer is usually the party in the EU that can be reached, yet it is often the least able to inspect the evidence. A manufacturer based outside the EU may hold the source code, the vulnerability handling records and the risk assessment, none of which the importer can examine in depth. Where the manufacturer is out of reach, the regulation still places the duty on the importer, so the importer's practical protection is contractual and procedural: require the documents before the first shipment, agree how updates and vulnerability reports will be exchanged, and record each check. Confirm with counsel how far the importer may rely on documents it cannot test, and what it should do if the manufacturer stops responding. The regulation's own timing for these duties is set out in the Regulation (EU) 2024/2847 text on EUR-Lex.
Which importers and products Article 19 reaches and where the work changes
Article 19 applies to importers who place a non-EU manufacturer's product on the EU market, and the amount of checking they owe depends on what the product is and how it is classified. The cards below cover the decisions that set that workload, from the product's category to whether the importer also takes on manufacturer duties.
Confirm the importer role
An importer is the EU-established party that places a product from a non-EU manufacturer on the EU market under its own name or trademark. Distributors who only make an already-placed product available are covered by Article 20 instead. Map every entity that brings products into the EU and record which ones hold the importer role for each product line. Check contracts and shipping arrangements, since a party that rebrands or adds its name to a product can change its position under the regulation.
Classify each product by category
The category sets the route. Default products usually follow self-assessment. Products in the important classes (Annex III class I or II) and critical products (Annex IV) carry heavier conformity assessment routes that involve a notified body in most cases. Importers should confirm the category with the manufacturer's documentation before accepting a shipment, because the checks Article 19 requires expand with each step up in classification. Ask the manufacturer to name the Annex and class in writing.
Match the technical description
The Commission's implementing regulation gives a technical description of each important and critical category. Importers should compare the product's actual core functionality against that description, not the marketing name. A router, firewall or identity component can sit in a different category from a general-purpose device with similar parts. Record the comparison in the importer file so an authority can see why the category was accepted.
Scope by product family and version
Importers often receive a product family rather than a single item. Define the family by model, hardware revision and firmware or software branch, and check whether each version carries the same conformity documentation. A new software release that changes security-relevant behavior may need its own check. Keep a register that links each shipped version to the declaration of conformity, the technical documentation reference and the support end date, so a later request from authorities can be answered from one place.
Check whether the importer also modifies
An importer that puts its own name on a product and changes its functionality, or that alters the product substantially, can take on manufacturer duties under Article 13. In that case the importer must meet the manufacturer's full set of obligations, including the technical documentation and the vulnerability handling process, and Article 19 checks become a smaller part of the work. Decide the role in writing before the first shipment, and identify which party controls the product's design, firmware and update channel.
Place products before the start date
Products placed on the EU market before 11 December 2027 fall under the regulation only if they are substantially modified from that date. The Article 14 reporting duties still apply to in-scope products whenever they were placed on the market. Importers holding older stock should separate it from new shipments in their records, since the obligations for each batch can differ. Confirm with the manufacturer which firmware or software build each batch carries.
How an importer builds a verification file before placing a product on the market
This sequence gives an importer a documented record that the manufacturer's conformity evidence exists, that the product carries the required marking and information, and that a clear decision was made before the product reaches the EU market.
Identify the manufacturer and the product
The importer records the manufacturer's legal name, registered trade name or trademark, postal address and the exact product identifiers, including model, version and batch or serial details where they exist. The importer compares these against the product as it arrives, including its packaging and accompanying documents. The step is complete when a single product record links the manufacturer identity to the specific items being imported, and any mismatch is logged for follow-up before anything else proceeds.
Collect the EU declaration of conformity
The importer requests the EU declaration of conformity from the manufacturer and stores a copy in the verification file. The importer checks that the declaration names the product, identifies the manufacturer, refers to the applicable requirements and is signed or otherwise authenticated as the manufacturer's document. The importer keeps this copy, because Article 19 requires it to be retained for the period set out in the article. The output is a dated, versioned copy of the declaration linked to the product record.
Confirm access to the technical documentation
The importer confirms, in writing, that the manufacturer has drawn up technical documentation and that the importer can obtain it promptly if a market surveillance authority asks. The importer does not need to hold a full copy of every design file, but it must know where the documentation is kept, who maintains it and how it would be delivered. The output is a signed access statement or contract clause, plus a named contact at the manufacturer for document requests.
Verify the CE marking and Annex II information
The importer checks that the CE marking is affixed to the product, or to its packaging or accompanying documents where the marking format allows, and that the user information described in Annex II accompanies the product in a form users can read. The importer compares the wording and content against the manufacturer's supplied information and records any gaps. The output is a checklist, dated and initialed, showing each marking and information item as present, absent or pending.
Check the manufacturer and importer contact details
The importer confirms that its own name, registered trade name or trademark, postal address and email or other digital contact appear on the product, its packaging or an accompanying document, as Article 19 requires. The importer also confirms that the manufacturer's contact details are present in the information supplied to users. The output is a photographed or scanned record of where each contact detail appears, so the importer can show the placement on request.
Set the hold decision rule
Before the product is placed on the market, the importer agrees a written rule for when it must not proceed. The rule covers any missing declaration, documentation access, marking or information item, and any belief that the product or the manufacturer's processes do not conform. Under Article 19, a product may not be placed on the market in those cases. The output is an approved decision rule, with named approvers, applied to each shipment and recorded as either release or hold.
Record the notification route
The importer documents who it informs when a vulnerability or significant cybersecurity risk becomes known, and how fast it does so under Article 19. Where the product presents a significant cybersecurity risk, the importer must inform the manufacturer and the market surveillance authorities, and must tell authorities if the manufacturer has ceased operations and cannot comply. The importer also confirms how it would reach users. The output is a notification procedure with named roles, contact paths and a log template, linked to the product record and the file retention plan.
How a market surveillance authority or auditor tests importer duties
This table compares what an authority or assessor checks under Article 19, the evidence it asks for, and where importers usually fall short. Read it as a test plan: each row is a check, and the evidence column shows what an importer should be able to produce on request.
| Test step | What the assessor checks | Evidence requested from the importer | Common finding |
|---|---|---|---|
| Product sampling | Whether the imported product is on the EU market with the CE marking and the Annex II user information | Sample units, product photos, labels, packaging and the user information as placed on the market | CE marking or user information missing from packaging or the accompanying document |
| EU declaration of conformity | That a copy exists, matches the product and was obtained before the product was placed on the market | The signed declaration, version history and the record of when it was received from the manufacturer | Declaration present but not matched to the product model or software version |
| Technical documentation | That the manufacturer drew up the documentation and that it can be made available to authorities | Confirmation of how the documentation can be requested, its retention location and the request log | Importer cannot show the documentation was ever requested from or provided by the manufacturer |
| Importer contact details | Name, registered trade name or trademark, postal address and digital contact on the product, packaging or accompanying document | Photographs of the markings and the accompanying documents for each product line | Address or email absent from packaging, or details differ from the manufacturer's registration |
| Nonconforming product decisions | Whether the importer withheld placing on the market when it believed the product or manufacturer processes did not conform | Pre-placement checklists, hold decisions, notices sent to the manufacturer and authority notifications where a significant risk existed | No written decision record for products that were released despite doubts about conformity |
| Vulnerability and risk notices | Whether vulnerabilities were passed to the manufacturer without undue delay and authorities were told of significant risks immediately | Intake log, timestamps, forwarding emails to the manufacturer and copies of any authority notifications | Vulnerability reports received from users or researchers were not forwarded, or the forwarding date cannot be shown |
| Manufacturer cessation | Whether the importer informed authorities and, as far as possible, users when the manufacturer ceased operations | Monitoring records for the manufacturer's status and any communications to authorities and customers | No process to detect the manufacturer stopping operations or cannot comply |
| Record retention | Whether the declaration and documentation can be produced for at least 10 years or the support period, whichever is longer | Retention schedule, archive location, access controls and a sample retrieval exercise | Records held in personal mailboxes or deleted on a shorter schedule |
Evidence that shows an importer met Article 19
Article 19 asks importers to show, for each product they place on the market, that the manufacturer had done the conformity work before the product arrived. The cards below describe the records that prove this, how each one connects to a specific Article 19 duty, and how to keep them current across the support period.
Per-product verification records
Keep one record for each product model and version you import. It should list the manufacturer, the product identifier, the conformity route the manufacturer used, and the date you checked each item in Article 19(1) and (2): the conformity assessment, the technical documentation, the CE marking and the declaration with user information. Sign and date each record. An assessor who asks how you knew a specific shipment was compliant should be able to find the answer in one place.
Copies of the EU declaration
Store a copy of the EU declaration of conformity for every product you place on the market, linked to the verification record and the batch or shipment it covered. Article 19(6) requires you to keep this copy, so the file must survive staff turnover and supplier changes. Check that each copy names the product version you actually sold, since a declaration for an earlier version does not cover a later one.
Access logs and agreements for technical documentation
Article 19(6) requires that technical documentation can be made available to authorities. Where you do not hold the documentation yourself, keep the contract or access agreement that gives you the right to obtain it, plus a log of each time you retrieved or tested access to it. Confirm the manufacturer's response time in writing, because a request from a market surveillance authority will not wait for a supplier's ticket queue.
Marking and labeling checks
Record the inspection of the product, its packaging and accompanying documents against Article 19(4). Note whether your name, registered trade name or trademark, postal address and digital contact appear, and where. Photograph the marking on a sample from each batch. Missing importer details are a common gap when a product is repackaged or shipped under a new distributor label, so repeat this check after any change to packaging.
Hold decisions and manufacturer notifications
Keep a decision log for every product you withheld because you believed it, or the manufacturer's processes, did not conform under Article 19(3). Record the reason, who decided, the date, and whether you informed the manufacturer and market surveillance authorities. Keep the same kind of log for vulnerabilities you reported to the manufacturer under Article 19(5), including the date you became aware and the date you informed them. The timing is part of the evidence, so do not reconstruct it later from email search.
Retention index and version history
Maintain one index that maps each product to its declaration, documentation access record, verification record and retention end date. Set the end date as the later of ten years after placing on the market or the end of the support period, as Article 19(6) requires. Store the index and each record in a version-controlled wiki so you can show what changed, when and by whom. Ask your platform provider to confirm how page history and access permissions are retained before you rely on them.
What meeting Article 19 costs in money and effort
This table breaks down the cost components of importer duties under Article 19, who is paid for each one, whether it is one-time or recurring, and what drives it up. Use it to build a scope for quotes and to see which work an importer can keep in house. No fees or durations are given because none were supplied for this topic, so every figure should come from the quote itself.
| Cost component | One-time or recurring | Who is paid or who carries it | What drives the cost |
|---|---|---|---|
| Staff time for conformity checks | Per product, then recurring on each new version | Internal compliance or product staff, or an outside reviewer | Number of products, how many are new or updated, and whether manufacturer evidence arrives complete |
| Legal review of manufacturer agreements | One-time for the template, recurring for each new supplier | Internal legal counsel or an external law firm | Number of non-EU manufacturers, contract history, and whether terms on vulnerability notice and cooperation already exist |
| Verification of technical documentation and EU declaration | Recurring with each placing on the market | Internal engineers or an implementation partner preparing review material | Depth of the manufacturer's technical file and how often the product changes |
| Labeling and contact details on product or packaging | One-time setup, recurring per shipment or batch | Importer operations and packaging suppliers | Physical or digital product format, and the number of SKUs and variants |
| Ten-year document storage | Recurring for the whole retention period | Importer IT or a records vendor | Volume of files, retention system, backup and access controls, and the support period length |
| Vulnerability and risk notification handling | Recurring, with spikes after an incident | Importer security or product security staff, with legal input | Number of in-scope products, speed of manufacturer response, and whether a notification process is already defined |
| External review or independent assessment | Usually project-based, sometimes recurring | Outside consultant, implementation partner, or auditor, scoped in writing | Scope of products reviewed, sample depth, and whether the review also covers record keeping |
Who does what for importer obligations: the importer, a partner and the authority
The importer carries the legal duties in Article 19. Before any product from a non-EU manufacturer is placed on the EU market, the importer's own staff must confirm that the conformity assessment was carried out, that technical documentation exists, that the CE marking is affixed and that the EU declaration of conformity and Annex II user information accompany the product. Procurement and compliance teams own the decision to place a product on the market, and they must be able to stop a shipment when a check fails.
- Supplier intake: Procurement asks each non-EU manufacturer for the declaration, documentation index and a named contact before a contract is signed.
- Go or no-go decision: A named compliance owner signs off each product family before it is placed on the market, and the decision is recorded.
- Contact details: The importer's name, trade name or trademark, postal address and digital contact must appear on the product, its packaging or an accompanying document.
- Vulnerability and risk notices: The team routes vulnerability information to the manufacturer without undue delay and informs authorities immediately where the product presents a significant cybersecurity risk.
- Record keeping: Copies of declarations and access to technical documentation are kept for at least 10 years or the support period, whichever is longer.
Check that each of these steps has a named owner and that the owner can show who approved each product.
An implementation partner can prepare the workflow and evidence that the importer's team uses. This work is preparation, not certification. The partner builds checklists, intake forms, document registers, notification runbooks and retention schedules, and configures the internal systems that store them. The importer remains responsible for every decision made with those tools, and the partner does not sign declarations, issue conformity findings or act as the importer of record.
- Verification workflow: The partner maps each Article 19 duty to a step, owner and evidence item that the importer can run for each product.
- Evidence templates: Templates for supplier declarations, documentation requests and go or no-go records are drafted for the importer's legal review.
- Document control: A version-controlled repository is configured so that each release of technical documentation and each declaration can be traced and retrieved for the retention period.
- Notification runbooks: Written steps tell staff how to escalate a vulnerability, contact the manufacturer and reach the relevant authority.
- Testing and handover: The partner runs a dry run of the workflow with the importer's staff and hands over the working files.
Before you engage a partner, ask for the written scope, the list of deliverables and a statement of which decisions remain with your staff.
Enforcement sits with national market surveillance authorities, which check products and can act against importers that place non-conforming products on the market. Under the market surveillance framework, these authorities coordinate through the administrative cooperation group. Conformity assessment, where a notified body is needed, is performed by a body that Member States notify and that appears in the Commission's NANDO system. Independent assessors and notified bodies issue findings and certificates. Neither the authority nor the assessor works for the importer, and neither is replaced by an implementation partner.
- Market surveillance: National authorities can request documents, test products and require corrective action or withdrawal.
- Notified bodies: Where the conformity route requires one, the body performs independent assessment and issues the outcome.
- Reporting channel: From 11 September 2026, manufacturer reporting runs through ENISA's Single Reporting Platform, and importers that learn of a significant risk must still inform authorities directly.
- Discontinued manufacturers: If a manufacturer ceases operations, the importer must inform authorities and, as far as possible, users.
- Fines: Penalties are set by Article 64 and are imposed by the authorities, not by partners.
Confirm with the relevant national authority which contact route applies to your products and whether a notified body is required for your product class.
Where importers usually fall short on Article 19
Most Article 19 failures are not dramatic. They come from accepting a supplier's paperwork at face value, leaving contact details off the product, and having no written trail for hold decisions, retention or vulnerability notices. Each card below names one gap, why it matters under Article 19, and the check that closes it.
Accepting marketing claims as conformity
An importer may only place a product on the market after confirming the manufacturer carried out the conformity assessment, drew up the technical documentation, affixed the CE marking and supplied the EU declaration of conformity and Annex II user information. A brochure or sales email claiming compliance does not meet that test. Ask for the EU declaration of conformity and the technical documentation itself, then check that the product identifiers match. Keep the copies on file.
Missing importer contact details
Article 19(4) requires the importer's name, registered trade name or trademark, postal address and an email or other digital contact on the product, its packaging or an accompanying document. Imported goods often reach the EU with the manufacturer's labels only, and importers add their own details late or not at all. Check the physical unit and its packaging before release, not the supplier's spec sheet. Record the check with a photo and the date.
No record of hold decisions
Article 19(3) bars placing a product on the market when the importer believes it or the manufacturer's processes do not conform, and requires notice to the manufacturer and market surveillance authorities where the product presents a significant cybersecurity risk. If a shipment is held, the reason, the evidence reviewed and the person who decided must be written down. Log every hold, release and escalation in one register so the decision can be shown later.
Retention that stops too early
Article 19(6) requires importers to keep a copy of the EU declaration of conformity and make the technical documentation available to authorities for at least 10 years after placing on the market or for the support period, whichever is longer. A retention rule set to a fixed period can expire before a long support period ends. Set the retention date per product from the support period the manufacturer discloses, and review it when that period changes.
No route for vulnerability notices
Article 19(5) requires importers to inform the manufacturer without undue delay of any vulnerability they become aware of, and to inform market surveillance authorities immediately where a product presents a significant cybersecurity risk. Many importers have no named contact at the manufacturer for security matters, so a notice sits in a general inbox. Agree a security contact and escalation path with each manufacturer in writing before the first shipment.
No plan for manufacturer exit
Article 19(8) asks importers to inform authorities and, as far as possible, users if they learn that the manufacturer has ceased operations and cannot comply. Without a monitoring step, an importer may keep selling a product that no longer receives fixes. Review the status of each manufacturer on a fixed schedule and record who would make the notification and to whom.
Questions importers ask about Article 19 cost, effort and outside help
How much effort does Article 19 verification take for an importer?
The effort depends on how much of the manufacturer's conformity file you receive and how well you can check it. Article 19 requires you to confirm, before placing a product on the market, that the manufacturer completed the conformity assessment, drew up technical documentation, affixed the CE marking and supplied the EU declaration of conformity and the Annex II user information. For a product with a clean, complete file, this is a document review and a set of checks against the product itself. For a product with gaps, the work grows quickly because you must either obtain the missing items or hold the product back. Ask your supplier for the full file before you sign the purchase order, and treat missing documents as a stop signal rather than a paperwork delay.
Can an importer handle Article 19 obligations in-house?
Yes, many importers can, provided they have someone who understands the regulation and can read technical documentation. The core tasks are a document check, a record of what you verified, the name and contact details you must place on the product or its packaging, and a process for passing vulnerability information to the manufacturer and, where a significant risk exists, to market surveillance authorities. The harder part is judging whether the technical documentation is credible, which often needs engineering input. Organizations with few imported products can usually absorb this internally. Organizations importing many product lines may prefer a documented intake checklist maintained by a small team, supported by outside review when a file looks incomplete.
What does Article 19 need from procurement and engineering?
Procurement and engineering each hold part of the evidence. Procurement should write the Article 19 document list into supplier contracts, including the EU declaration of conformity, the technical documentation access terms, the user information and a commitment to notify you of vulnerabilities. Engineering should check the product itself: the CE marking, the contact details on the device or packaging, the presence of the user information and any security configuration the manufacturer describes. Engineering also needs a route for vulnerability reports that arrive after the product is on the market. Agree these responsibilities in writing before the first shipment, because the importer's duties apply before placing the product on the market.
How long must an importer keep Article 19 records?
Article 19(6) requires importers to keep a copy of the EU declaration of conformity and to ensure the technical documentation can be made available to authorities for at least 10 years after the product is placed on the market, or for the support period if that is longer. Because the support period can run for years and may be extended, the longer period often governs. Set retention to the later of the two dates for each product model, not for each shipment. Store records in a system with version history so you can show which file was current when you placed the product on the market. Confirm the retention rule with your legal team for your specific products.
What drives the cost of Article 19 compliance for an importer?
The main cost drivers are the number of product models you import, the completeness of the manufacturer's files, and how often you must chase missing items. Costs are mostly staff time for document review, engineering checks, record keeping and supplier management, and these recur with each new model or major update. Outside help adds fees only when you buy it. Ask any provider for a fixed-scope quote that lists the products covered, the documents reviewed, the record system delivered and any recurring review. The regulation itself does not set a fee, and no supplied source gives a figure for importer verification effort, so confirm expected effort with your own product inventory.
When is outside help worth buying for Article 19?
Outside help is worth considering when the file review needs specialist judgment, when you import several product lines, or when your internal team cannot maintain a record system with reliable version history. A consultant can also build the intake checklist, the vulnerability routing process and the contact labeling workflow so your staff can run them afterward. DeployOpen prepares systems, controls and evidence for compliance assessments and implements self-hosted open-source platforms in your own infrastructure, which can include a records system for importer documentation. It does not review or certify a manufacturer's conformity, and only an independent auditor or certification body issues reports or certificates. Ask for a written, fixed scope that names deliverables and timelines before work starts.
Which tools can keep Article 19 records with version history?
A wiki or document platform with version control is a practical starting point for an importer's record set. XWiki keeps every change to a page under version control, recording what changed, when and by whom, and lets users compare any two versions and roll back to an earlier one. BookStack lets you set permissions by role and override them at the shelf, book, chapter or page level, which helps separate who can edit importer files from who can only read them. Confirm that either tool meets your own retention and access requirements, because the choice of system does not replace the verification work itself. Store the signed declaration and the technical documentation access record in the same place.
How DeployOpen prepares importer verification workflows and evidence
DeployOpen plans, implements and documents the systems an importer uses to check Article 19 duties before a product reaches the EU market and while it is on sale. The importer keeps ownership of its verification decisions, and DeployOpen prepares the workflows, records and evidence those decisions rely on, inside the importer's own infrastructure.
How we scope
- Written scope lists which product lines, manufacturers and import channels the Article 19 workflow must cover before work starts.
- Scope names the evidence the importer must hold: EU declaration of conformity, technical documentation access, CE marking and Annex II user information.
- Engagements are fixed-scope, so deliverables and timelines are agreed in writing before any build begins.
How we build
- Self-hosted open-source platforms are configured to hold manufacturer documents, declarations and version records for each imported product.
- Intake checklists are set up so a product cannot move to market until each Article 19 check has a named owner and a dated record.
- Notification paths for significant risks and vulnerabilities to manufacturers and market surveillance authorities are written into runbooks and tested.
How we hand over
- Handover includes written procedures, configuration documentation and a register mapping each Article 19 duty to the system and record that proves it.
- Retention settings are documented against the ten-year record keeping period, with the support period checked for longer retention.
- The importer's staff are walked through the workflows so they can operate and audit the records without DeployOpen involved day to day.
How we support
- Ongoing support, upgrades and continuous testing of the platforms are available as retainers after handover.
- Retainers can cover updates to the verification workflow when manufacturers, product lines or implementing guidance change.
- DeployOpen prepares evidence for review, but independent auditors and certification bodies issue any reports or certificates, and the importer should confirm which assessments it needs.
