Article 20 CRA distributor obligations: due care and evidence

What Article 20 asks distributors to check before selling a product

Article 20 requires a distributor, meaning a reseller or any other party in the supply chain that makes a product with digital elements available on the EU market, to act with due care toward the regulation's requirements before the product is sold. In practice that means checking, before the first sale, that the product bears the CE marking and that the manufacturer and the importer have met their identification, contact, user information, support period and declaration obligations and supplied the necessary documents. If a product does not conform, the distributor must not make it available, must make sure corrective measures, withdrawal or recall happen, and must inform the manufacturer and the market surveillance authorities where the product poses a significant cybersecurity risk. It must also pass on to the manufacturer, without undue delay, any vulnerability it becomes aware of. The risk Article 20 addresses is simple to state: a nonconforming product reaches end users who have no way to judge its security, and the reseller is the last party with a chance to stop it. The difficulty is that the evidence sits outside the distributor's control. The technical documentation, the declaration and the support period disclosure come from the manufacturer or importer, and the distributor usually sees only what is packaged or posted with the listing. A practical first step is to write a short intake checklist that maps each Article 20(2) item to a document the distributor can request and file, and to decide in advance who may pull a listing when a document is missing or a vulnerability report arrives.

Distributors with older stock should also know where the obligation stops. The Commission's FAQ (question 7.5) states that distributors are not required to bring products placed on the market before 11 December 2027 into compliance unless they carry out a substantial modification. Stock already on shelves before that date therefore does not need a retrofit by the distributor, but a distributor that alters the product, for example by changing its firmware or configuration in a way that counts as a substantial modification, should confirm with the manufacturer whether that change brings the product within the regulation. Readers should check the exact wording of Article 20 and the FAQ in the Commission FAQs on the Cyber Resilience Act and confirm how their own legal advisers read the substantial modification test before relying on it.

Which distributors and products Article 20 covers

Article 20 applies to whoever makes a product available on the EU market without being its manufacturer or importer. Four scoping questions decide how much verification work lands on a distributor: the role it actually plays, the products in play, the channel it sells through, and the date the product reached the market.

Distributor versus importer or manufacturer

A distributor makes a product available on the market without placing its own name or trademark on it and without importing it from outside the EU. If your organization is the first to bring a non-EU product into the Union, Article 19 applies to you as an importer instead. If you put your own name or trademark on the product, you are the manufacturer under Article 13. Check the label, the contract and the import record before assuming the lighter distributor role.

Products with digital elements in scope

Article 20 reaches every product with digital elements the regulation covers, including hardware with software and standalone software placed on the market. Products excluded from the regulation's scope do not trigger these checks. Confirm the scope position for each SKU, firmware build and software package in your catalog, because a scope decision made for one product does not carry over to a neighboring product line.

Online marketplaces and resellers

An online marketplace or reseller that lists products from third parties still makes those products available on the market, so the due care duties of Article 20 apply to the listing. The practical question is whether the platform receives the CE marking, the manufacturer's and importer's documents and the support period information before a listing goes live. Ask sellers for these items and build a hold step into onboarding.

Software resale and license distribution

Resellers of software licenses, reseller agreements and distribution through app stores or download portals each need a clear answer on whether they make the product available. Map who controls the download, the license key and the update channel. A distributor that only resells licenses under a manufacturer's own terms has different checks from one that repackages, bundles or hosts the software.

Substantial modification and the 11 December 2027 date

Products placed on the market before 11 December 2027 fall under the regulation only if they are substantially modified from that date. The Commission's FAQ states that distributors need not bring such products into compliance unless they carry out a substantial modification themselves. Treat any repackaging, firmware change or functional rewrite as a possible modification and record the decision that you made about it.

Reporting duties regardless of market date

The date that matters for old stock is not the same for every obligation. The Article 14 reporting duties apply to in-scope products whenever they were placed on the market, so a distributor holding older products may still need to pass on vulnerability information. Confirm with the manufacturer which stock is covered and keep a contact route for notifications on every product line.

How an assessor tests distributor due care

This table sets out how an assessor tests each Article 20 duty, the evidence it expects to see and the findings that come up most often. Assessors are market surveillance authorities or independent assessors who sample product listings and records, so read each row as a question you should be able to answer with a document. The main takeaway is that distributor due care is judged on what was checked before sale and what happened afterwards, not on policy statements alone.

Duty	How the assessor tests it	Evidence requested	Common findings
Verify CE marking and documentation before sale	Samples listings and stock, then asks for the pre-sale check record for each sampled product	Dated checklist per product showing CE marking, manufacturer and importer details, declaration and user information	Checks done only once at onboarding, not per product or per version
Confirm manufacturer and importer obligations were met	Compares the product file with the identification, contact, support period and declaration information it should carry	Copies of the EU declaration, support period statement and importer details held on file	Missing support end date or contact details accepted without follow-up
Withhold nonconforming products	Looks for evidence that products failing checks were stopped from sale, including online listings	Hold or block records, listing takedown logs and internal sign-off before reinstatement	No documented hold step, or listings left live after a failed check
Corrective action, withdrawal and recall	Asks how the distributor ensured corrective measures were taken where a product was already on sale	Recall or withdrawal procedure, customer notices and records of which units were reached	Procedure exists on paper but has never been tested or traced to specific units
Inform manufacturer of vulnerabilities	Checks whether vulnerability information reached the manufacturer without undue delay	Log of reported vulnerabilities with dates, recipients and acknowledgement from the manufacturer	No named contact, or reports sent to a general mailbox with no reply on file
Inform authorities of significant cybersecurity risk	Tests whether the distributor escalated products posing significant risk to manufacturer and authorities	Escalation records and the decision trail showing why a case was or was not escalated	Decisions made informally with no written rationale
Cooperate with market surveillance authorities	Requests documents and a named contact and checks response times and completeness	Contact point for authorities, document retrieval process and examples of past requests answered	Requests answered late, or records scattered across mailboxes and shared drives

Building a pre-sale verification process for distributors

This sequence turns Article 20 into a repeatable routine: know which products you carry, check each one before it is offered, hold back anything nonconforming, pass vulnerability information on without undue delay, and know who to contact at the authorities. Each step ends with a record that shows the check was done.

Inventory supplier and product relationships
Start by listing every manufacturer and importer you buy from, every product line you resell or distribute, and the EU market your distribution reaches. Assign an owner in procurement or compliance to keep the list current. The step is complete when each product has a named supplier, a identified importer where the manufacturer is outside the EU, and a status showing whether it falls under the regulation's scope. Treat this register as the starting point for every later step.
Define a pre-listing checklist
Write a checklist that mirrors what Article 20(2) asks you to verify before a product is made available: the CE marking, the manufacturer's identification and contact details, user information, the support period, the EU declaration of conformity, and the technical documentation the manufacturer and importer must hold. Ask legal or compliance counsel to confirm the wording against the regulation text. The output is an approved checklist with a sign-off field for each item and a rule that no product is listed until every field is complete.
Verify documents for each product before listing
For each product, a trained reviewer works through the checklist using the documents the supplier provides, and confirms that the CE marking and declarations match the product as delivered. Where a document is missing, the reviewer requests it in writing and records the request. Ask suppliers to confirm which version of the product the documentation covers. The step closes with a dated verification record per product, kept in the same register, that a second person can read without asking the original reviewer.
Hold and escalate nonconforming products
Set a written procedure for products that fail verification or that later show signs of nonconformity. The reviewer places the product on hold so it is not offered for sale, records the reason, and escalates to the compliance lead. The compliance lead decides whether to return the product, ask for corrective measures from the manufacturer, or inform the market surveillance authority where the product poses a significant cybersecurity risk. Define who may lift a hold. The output is a hold log entry with the decision, the reviewer, and the date.
Route vulnerability information to the manufacturer
Create a single intake channel, such as a shared mailbox or ticket queue, where staff, customers, and external researchers can report suspected vulnerabilities in products you distribute. Triage each report within the team, confirm whether it concerns a product in your register, and forward it to the manufacturer without undue delay under Article 20(4). Keep a copy of each forwarding message with its timestamp. The step is complete when a test report can be traced from intake to the manufacturer's acknowledgement.
Set up cooperation with authorities
Identify the market surveillance authority responsible for each Member State where you distribute products, and record the contact route each one publishes. Name a single responsible contact who can answer information requests, supply the product and supplier records from your register, and coordinate with manufacturers on corrective action, withdrawal, or recall. Ask counsel to confirm the procedure for notifying authorities on significant cybersecurity risks. The output is a contact sheet and a request-handling procedure that has been tested with one dry run.
Store and review the verification records
Keep the register, checklists, hold log, forwarding records and authority correspondence in a controlled repository with version history and role-based access, so that changes and approvals can be traced. Review the register when a supplier changes, a product is substantially modified, or a new vulnerability report arrives. Confirm with your own counsel how long records must be kept. The step is complete when an assessor or authority can see who checked what, when, and what was decided.

Where the distributor's due care stops and the manufacturer's duties begin

A distributor's job under Article 20 is to verify, hold back and relay. It is not to design controls, write the technical documentation or issue the EU declaration of conformity. Those belong to the manufacturer, and where the manufacturer is outside the EU, to the importer. Before a product is made available, a distributor should check that the CE marking is present and that the manufacturer and importer have supplied the identification, contact, user information, support period and declaration material the regulation requires. If that material is missing, the distributor should not sell the product until it arrives. The practical step is to write a intake checklist with the document names, the expected version and a named person who signs off each product before listing. Confirm the exact document set against the regulation text and the Commission FAQs rather than relying on an internal summary.

Once a product is on sale, the distributor's duties change shape. If a product turns out to be nonconforming, the distributor must not keep supplying it, must make sure corrective measures, withdrawal or recall happen, and must inform the manufacturer and the market surveillance authorities where the product presents a significant cybersecurity risk. The distributor also has to pass on any vulnerability it becomes aware of to the manufacturer without undue delay. Keep a record of who was told, when and through which channel, because that record is the evidence of due care. Agree in advance with each manufacturer which contact receives these reports and how fast the distributor expects an acknowledgement.

The boundary moves when a distributor changes the product. If it alters hardware or software in a way that counts as a substantial modification, or puts its own name or trademark on the product, the Article 20 role can become a manufacturer role with the full set of Article 13 duties. Illustrative example: a regional reseller repackages a connected device with its own firmware build and its own brand. Before shipping, it should ask whether that change is a substantial modification under the Commission's guidance, and if so, plan for technical documentation, conformity assessment and support obligations of its own. Confirm this boundary with counsel and the guidance text before the first sale, since the answer decides who carries the liability.

Evidence that shows distributor due care

Article 20 asks distributors to verify before they sell and to act when a product turns out to be nonconforming. The cards below cover the records that show those checks happened, who signed them and when. Keep them current between audits so the file reflects the product as it is on the shelf today.

Pre-sale checklist with dated sign-off

Keep one checklist per product or product version, completed before the product is first made available. Each item maps to a point in Article 20(2): CE marking present, manufacturer and importer identification and contact details, user information, support period disclosure, declaration of conformity and the technical documents the manufacturer must supply. Record the name of the person who signed and the date. A checklist without a date cannot show that the check came before the sale.

Copies of CE marking and declaration records

Store a copy of the CE marking as it appears on the product or packaging, and a copy of the EU declaration of conformity the manufacturer supplied. Compare the product identifier on each record with the identifier on the goods you received. Mismatched model numbers or versions are a common reason a file fails to support the sale, so note any discrepancy and the action taken.

Supplier documentation register

Maintain a register listing each manufacturer and importer, the products they supply, the documents received and the date each document was last reviewed. Include the support period the manufacturer disclosed for each product. Review the register on a fixed schedule and whenever a supplier sends a new version, so you can show which documentation was in force when each unit was sold.

Nonconformity hold records

When a product fails a check, record the hold: the product, the failed item, the date, who decided not to make it available, and what happened next. Article 20(3) prohibits making nonconforming products available, and Article 20(4) requires corrective measures, withdrawal or recall where needed. Keep the release decision with the hold record so a later release is traceable to a documented re-check.

Vulnerability relay logs

Log each vulnerability you learn of about a product you distribute, with the date you became aware, the notice sent to the manufacturer and the time it was sent. Article 20(4) requires notice to the manufacturer without undue delay. Where a product poses a significant cybersecurity risk, the log should also show the notice to the authorities. Confirm how your own process defines awareness, since the timing question will depend on it.

Authority correspondence and version history

File every exchange with market surveillance authorities, with the request, your response and any follow-up. Keep these records under version control so that edits show what changed, when and by whom, and so earlier versions remain available. A versioned record lets you show what the file said on the date of a sale, which matters more than the current state when an assessor reviews past decisions.

What meeting Article 20 costs in money and effort

Article 20 cost is mostly staff time. A distributor pays its own compliance, procurement, legal and product staff to check each product before it is offered, and it may pay outside reviewers for parts of that work. The regulation does not set a fee, and no distributor-specific cost figure is supplied for this obligation, so the budget has to be built from the work itself.

Staff time for verification: Someone checks the CE marking and the manufacturer and importer documentation for each product line before it is made available.
Records tooling: A system that stores the documents received, the date of each check and the decision taken, so the file can be produced when an authority asks.
Legal review of supplier documents: Counsel or a trained compliance reviewer reads declarations and support period statements where the wording is unclear.
Training: Sales, procurement and order-handling staff learn to stop listings that lack documentation.
External review: An outside assessor reviews the verification process itself, not the products.

Ask each internal team and each outside provider to price its part separately, so the budget shows who is paid for which step.

Where distributors usually fall short

Most distributor failures under Article 20 come from process, not intent. The gaps below share one root cause: checks, holds and reports are handled ad hoc, so the organization cannot later prove what it verified or who acted. Each card names the gap and the control that closes it.

Inconsistent pre-listing checks

Listing teams often verify CE marking and documentation from memory, and two buyers may apply different standards to the same product. Article 20(2) expects verification before a product is made available, so a written checklist should cover the CE marking, the manufacturer's identification and contact details, user information, the support period declaration and the technical documents. Ask for the checklist version used for each listing, and confirm that it is applied to every new product and every new version.

No defined hold process

When a product fails a check, staff frequently have no authority or instruction to stop sales. Article 20(3) prohibits making nonconforming products available, and Article 20(3) and (4) also require corrective action, withdrawal or recall where needed. Define who can place a listing on hold, what evidence triggers the hold, who must approve release, and how the decision is recorded. Test the process once with a mock nonconforming product so the steps are known before a real case arrives.

Vulnerability reports stuck in sales inboxes

Vulnerability information often reaches a sales contact, a marketing mailbox or a regional account manager, and nobody routes it onward. Article 20(4) requires the distributor to inform the manufacturer without undue delay once it becomes aware of a vulnerability. Create a single intake address owned by a named role, add a rule that forwards reports to the manufacturer contact on file, and set a time target for relaying each report. Check that the intake channel is listed in your supplier onboarding documents.

Records that cannot show what was checked

A distributor may hold the right documents but cannot show which version of a document was reviewed, by whom, or when. Keep a dated record for each product and version: the checks performed, the result, the decision and the approver. Version-controlled documentation makes it possible to compare what was on file at each point in time. Confirm that your record system keeps history and that edits to approved entries leave an audit trail.

Missed post-sale vulnerability relay

Article 20 duties do not end at listing. A distributor that learns of a vulnerability after sale still has to pass it to the manufacturer, and the report may come from a customer, a researcher or a monitoring feed. Assign ownership of post-sale monitoring for each listed product, define what counts as a vulnerability report, and keep a log of relays. Review the log on a fixed schedule so gaps in relay are found before an authority asks about them.

Access that does not match duties

Staff who can publish listings often also control holds, approvals and records, which removes the separation an assessor would expect. Restrict each function to the roles that need it, and review assignments when people change jobs. Role-based permissions with overrides at the level of a shelf, book or page let you match access to each duty without granting blanket rights. Confirm that the approver for a hold cannot also be the person who published the listing.

Questions distributors ask about Article 20

Does Article 20 apply if we only resell software?

Yes, if you make software with digital elements available on the EU market in the course of business, you are acting as a distributor and Article 20 applies to you. The duties are checks you carry out before you make a product available, not design work on the product itself. You must confirm the product bears the CE marking, that the manufacturer and any importer have met their identification, contact, user information, support period and declaration obligations, and that the documents exist. Free and open-source software supplied outside a commercial market activity may fall outside these duties, so confirm the treatment of your specific product in the Commission FAQs on the Cyber Resilience Act and with counsel.

What does Article 20 compliance cost a distributor?

No price is set by the regulation, and this page does not supply a figure. The cost has two parts: internal staff time and any external help you buy. One-time costs include designing a document checklist, an intake process for new suppliers, training for purchasing and sales staff, and a procedure for holding back or withdrawing nonconforming products. Recurring costs include checking each new product version and supplier update, and handling vulnerability information passed up the chain. The main cost drivers are the number of suppliers and products, how much documentation suppliers already provide, and how many products include firmware or software you do not control. When requesting a quote, ask for the written scope, the deliverables, who performs each task, and which costs recur. DeployOpen works to a fixed scope agreed in writing, and a quote follows from that scope.

How long does setting up Article 20 checks take?

The duration depends on how many suppliers and products you handle and how complete their documentation already is, and this page does not supply a timeline. Key dates set the context: the regulation applies from 11 December 2027, while the Article 14 reporting obligations for manufacturers applied from 11 September 2026. Setting up checks is quicker when you already hold a supplier register and a product approval step. Staff needs are usually a compliance owner who signs off the checklist, a technical reviewer who can read technical documentation and support periods, a procurement contact who can ask suppliers for missing documents, and an operations contact who can remove a listing quickly. Before you commit to a schedule, ask any implementation partner to state the systems, documents and staff time they expect you to provide.

Can a distributor handle Article 20 in-house?

Generally yes. Article 20 places due care duties on the distributor itself, and no outside body must certify a distributor's checks. Your organization can build the checklist, run the reviews and keep the records. Outside help is useful for technical document reviews, training, or setting up a workable record system. Records must show what you checked, when, and who approved the product. A wiki with version history can hold this, since every change is kept and any two versions can be compared and rolled back, as described in the XWiki version control guide. Role-based permissions, such as those in BookStack, can limit who may approve or edit a record. Keep in mind that only independent auditors and certification bodies issue reports or certificates. An implementation partner such as DeployOpen can prepare systems and evidence, but it does not issue them.

What happens to products placed on the market before 11 December 2027?

Under the Commission's guidance, distributors are not required to bring products placed on the market before 11 December 2027 into compliance unless they carry out a substantial modification. That is the main point for stock already on your shelves or in your catalogue. The Article 14 reporting duty applies to in-scope products whenever they were placed on the market, so the reporting regime is not limited to new products. Your vulnerability handling duty also continues: if you become aware of a vulnerability in a product you distribute, you must inform the manufacturer without undue delay. Ask your suppliers which products they have placed on the market before the cut-off date and whether any update would count as a substantial modification. Confirm the position for your own products with the Commission's guidance and your legal advisers.

When does a reseller become a manufacturer under the CRA?

A reseller takes on manufacturer duties when it places a product on the market under its own name or trademark, or when it substantially modifies a product already on the market. Once that happens, the full manufacturer obligations apply, including the essential requirements, technical documentation, conformity assessment and CE marking. The Commission's guidance published on 27 July 2026 covers substantial modification, so read it before you rebrand or change a product materially. Consider an illustrative case: a distributor relabels a vendor's network appliance with its own brand and ships it under that name. The distributor would then need to treat itself as the manufacturer for that product. The exact wording of the rule should be confirmed with counsel, and you can review the Commission's CRA guidance for the Commission's explanation of these concepts.

Which documents must a distributor check before listing a product?

Before you make a product available, check that it bears the CE marking and that the manufacturer and any importer have met their obligations. In practice, that means confirming the following:

The manufacturer's name, registered trade name or trademark, and postal and electronic contact details are on the product or its packaging.
User information, including the instructions and safety information the manufacturer must supply, is included in a language the user can read.
The support period is disclosed and the end date is stated in the documents you received.
The EU declaration of conformity exists and matches the product version you are listing.
The manufacturer or importer has supplied the necessary technical documents on request.

Keep a dated copy of each check. If any item is missing, do not make the product available until the supplier resolves it.

How DeployOpen prepares distributor evidence

DeployOpen works with distributors and the organizations that supply them to prepare the systems, records and handover evidence that Article 20 Obligations of distributors calls for. Scope and deliverables are agreed in writing before work starts, and DeployOpen does not issue any declaration, report or certificate, which remains the role of the manufacturer, importer and independent assessors.

How we scope

Map which products you distribute and which manufacturer and importer documents each one should arrive with
Define the checks your team will run before making a product available, including CE marking and declaration review
Agree in writing how nonconforming products are held back, and who approves any release decision
Confirm the channel for passing vulnerability information to manufacturers without undue delay

How we build

Set up a document intake register that records what each manufacturer and importer supplied and when
Configure role-based access so only named staff can approve, hold or release a product in the workflow
Build version-controlled procedures for the due care checks, with a record of every change and reviewer
Test the hold, escalation and notification steps with a tabletop exercise before they are relied on

How we hand over

Deliver the written procedures, checklists, role assignments and intake templates to your compliance owner
Provide a documented evidence trail showing each check performed before a product was made available
Walk your team through the escalation path for significant cybersecurity risks and cooperation with authorities
Document open items and the owner responsible for each, so the next review starts from a known position

How we support

Review procedures when a manufacturer changes documentation or when the Commission publishes new guidance
Retain supporting staff for periodic evidence reviews and updates to intake registers under an agreed retainer
Coordinate with your independent assessor or legal advisers when they request records for review
Confirm with your legal advisers which obligations apply to your specific role and product mix