Reporting obligations and economic operators

The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, tells manufacturers to notify these items (Article 14):

actively exploited vulnerabilities
severe incidents having an impact on the security of the product with digital elements.

It also gives the obligations of the other economic operators of a product with digital elements, and of open-source software stewards (Articles 18 to 24).

Article 14 applies to manufacturers from 11 September 2026 (Article 71(2)). The other provisions below apply from 11 December 2027: Articles 13, 15 to 24, 53, and 54. Article 71(2) does not give Articles 15 and 16 a different date. But since 11 September 2026, manufacturers must use the single reporting platform for notifications in Article 14(1), (3), and (7). For all the dates, see the dates of the CRA.

Article 14 — Reporting obligations of manufacturers

Article 14 of the CRA tells a manufacturer to notify two items when it becomes aware of them:

an actively exploited vulnerability "contained in the product with digital elements" (Article 14(1))
a severe incident having an impact on the security of the product with digital elements (Article 14(3))

A CSIRT is a computer security incident response team. ENISA is the European Union Agency for Cybersecurity. The manufacturer must notify each item at the same time to the CSIRT designated as coordinator and to ENISA (Article 14(1) and (3)). It must send the notifications through the single reporting platform of Article 16 (Article 14(7)).

An actively exploited vulnerability is "a vulnerability for which there is reliable evidence that a malicious actor has exploited it in a system without permission of the system owner" (Article 3(42)). The Commission services FAQ tells manufacturers that a zero-day vulnerability is "subject to reporting" when the manufacturer "has reliable evidence that a malicious actor has exploited that vulnerability" (FAQ 5.2, not binding).

For "incident", Article 3(43) of the CRA refers to Article 6, point (6), of Directive (EU) 2022/2555. An incident of Article 3(44) is "severe" if one of these conditions occurs (Article 14(5)):

"it negatively affects or is capable of negatively affecting the ability of a product with digital elements to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions"
"it has led or is capable of leading to the introduction or execution of malicious code in a product with digital elements or in the network and information systems of a user of the product with digital elements"

ENISA operates the single reporting platform (Article 16(1)). ENISA started the "initial operating capability" of the single reporting platform on 11 September 2026. Since that date, manufacturers report through it (ENISA, 11 September 2026).

Time limits and contents of the notifications

Article 14(2) and (4) give the manufacturer three steps for each item. The time limits of the first two steps start when the manufacturer becomes aware of the item.

Step	Actively exploited vulnerability (Article 14(2))	Severe incident (Article 14(4))
Early warning notification	Without undue delay, and no more than 24 hours after the manufacturer becomes aware of the vulnerability. Where applicable, it identifies the Member States where the manufacturer knows that the product "has been made available".	Without undue delay, and no more than 24 hours after the manufacturer becomes aware of the incident. At a minimum, it tells the CSIRT designated as coordinator and ENISA if the incident "is suspected of being caused by unlawful or malicious acts". It also identifies these Member States, where applicable.
Vulnerability notification or incident notification	Unless "the relevant information has already been provided", a vulnerability notification, without undue delay, and no more than 72 hours after the manufacturer becomes aware of the vulnerability. It gives general information, "as available", about the product and "the general nature of the exploit and of the vulnerability concerned". It also gives the "corrective or mitigating measures taken" and the corrective or mitigating measures that users can apply. Where applicable, it tells the CSIRT designated as coordinator and ENISA "how sensitive the manufacturer considers the notified information to be".	Unless "the relevant information has already been provided", an incident notification, without undue delay, and no more than 72 hours after the manufacturer becomes aware of the incident. It gives general information, "where available", about "the nature of the incident, an initial assessment of the incident". It also gives the corrective or mitigating measures that the manufacturer applied and those that users can apply. Where applicable, it tells the CSIRT designated as coordinator and ENISA "how sensitive the manufacturer considers the notified information to be".
Final report	Unless "the relevant information has already been provided", a final report no more than 14 days after a corrective or mitigating measure is available. At a minimum, it includes "a description of the vulnerability, including its severity and impact", and "details about the security update or other corrective measures that have been made available to remedy the vulnerability". Where available, it also gives "information concerning any malicious actor that has exploited or that is exploiting the vulnerability".	Unless "the relevant information has already been provided", a final report no more than one month after the manufacturer sends the incident notification. At a minimum, it includes "a detailed description of the incident, including its severity and impact", "the type of threat or root cause that is likely to have triggered the incident", and "applied and ongoing mitigation measures".

The Commission approved the contents of its guidance on the CRA, and the guidance is not binding (see Guidance). In the guidance, the manufacturer "should assess the suspicious event immediately". The guidance also tells manufacturers that a manufacturer becomes aware when, after that initial assessment, it has "a reasonable degree of certainty" of one of these items (paragraphs 211 and 213):

a vulnerability in its product "is being actively exploited"
"a severe incident has occurred and has led to the security of its product with digital elements being compromised"

Where to send the notifications

Article 14(7) of the CRA tells the manufacturer which CSIRT designated as coordinator gets its notifications. The manufacturer sends them through the single reporting platform. It uses the electronic notification end-point of the CSIRT designated as coordinator in the Member State of its main establishment in the Union. ENISA has access to the notifications at the same time, subject to Article 16(2).

For a vulnerability notification of Article 14(2)(b), Article 16(2) gives conditions where ENISA gets only these items:

"the information that a notification was made by the manufacturer"
"the general information about the product"
"the information on the general nature of the exploit"
"the information that security related grounds were raised"

This limit is for "particularly exceptional circumstances" where the manufacturer identifies one of the conditions in Article 16(2), points (a) to (c), in its notification. It continues "until the full notification is disseminated to the CSIRTs concerned and ENISA".

The main establishment of the manufacturer is in the Member State "where the decisions related to the cybersecurity of its products with digital elements are predominantly taken". If it is not possible to find that Member State, the main establishment is in the Member State where the manufacturer has "the establishment with the highest number of employees in the Union".

A manufacturer with no main establishment in the Union uses the CSIRT designated as coordinator of the first applicable Member State in this sequence, "based on the information available to the manufacturer":

"the Member State in which the authorised representative acting on behalf of the manufacturer for the highest number of products with digital elements of that manufacturer is established"
"the Member State in which the importer placing on the market the highest number of products with digital elements of that manufacturer is established"
"the Member State in which the distributor making available on the market the highest number of products with digital elements of that manufacturer is established"
"the Member State in which the highest number of users of products with digital elements of that manufacturer are located"

For item 4, the manufacturer is permitted to send subsequent notifications to the same CSIRT designated as coordinator "to which it first reported" (Article 14(7)).

Where necessary, the CSIRT designated as coordinator that first gets the notification is permitted to "request manufacturers to provide an intermediate report on relevant status updates" (Article 14(6)).

That CSIRT designated as coordinator must send each notification without delay to the CSIRTs designated as coordinators of the Member States that the manufacturer identified (Article 16(2)). It uses the single reporting platform for this. "In exceptional circumstances", "the dissemination of the notification may be delayed based on justified cybersecurity-related grounds for a period of time that is strictly necessary". A "request" from the manufacturer is one example, "in light of the level of sensitivity of the notified information as indicated by the manufacturer". The Commission gives the "terms and conditions for applying the cybersecurity-related grounds" in Delegated Regulation (EU) 2026/881 of 11 December 2025 (its Article 1). It applies to the decision of the CSIRT designated as coordinator, and it does not change the time limits of the manufacturer in Article 14.

When Article 14 applies

By Article 69(3), Article 14 also applies to all products with digital elements in scope that were placed on the market before 11 December 2027 (see dates and transitional provisions).

For such a product, the Commission services FAQ and the Commission guidance tell manufacturers these points (FAQ 5.3, guidance paragraph 210):

The manufacturer must make the notifications of Article 14.
It is not necessary for the manufacturer to comply with the vulnerability handling obligations of Annex I, Part II.

Article 14(1) and (3) give no limit related to the support period. The guidance tells manufacturers that the reporting obligations continue after the support period of a product ends. The vulnerability handling obligations continue only for the support period (paragraph 210).

The guidance also tells manufacturers which vulnerabilities from before 11 September 2026 they must report (paragraph 217):

A report is not necessary if the manufacturer became aware of the active exploitation of the vulnerability before 11 September 2026.
A report is necessary if the manufacturer knew of the vulnerability before 11 September 2026, but becomes aware of its active exploitation after that date.

For open-source software stewards and persons considered to be a manufacturer, see the dates for Article 14 obligations before and from 11 December 2027.

Third-party components and voluntary reporting

Article 14(1) of the CRA applies to an actively exploited vulnerability "contained in the product with digital elements". The Commission guidance tells manufacturers these points about third-party components (paragraph 218):

The manufacturer notifies an actively exploited vulnerability in its product, also when the vulnerability comes from a third-party component.
A vulnerability in a third-party component that "cannot be exploited" in the product, or that "has not been exploited" in it, "is not subject to mandatory reporting for that manufacturer".
The manufacturer is permitted to notify such a vulnerability (Article 15). It must also apply Annex I, Part II, and report the vulnerability to "the person or entity manufacturing or maintaining the component" (Article 13(6)).

For Article 13(6), see Components.

In Article 15, manufacturers and other natural or legal persons are permitted to notify a CSIRT designated as coordinator or ENISA. They can notify these items:

"any vulnerability contained in a product with digital elements"
"cyber threats that could affect the risk profile of a product with digital elements"
"any incident having an impact on the security of the product with digital elements"
"near misses that could have resulted in such an incident"

Information to users and "the public" — Articles 14(8) and 17(2)

Article 14(8) of the CRA tells a manufacturer that becomes aware of an actively exploited vulnerability or a severe incident to tell "the impacted users of the product with digital elements, and where appropriate all users". The manufacturer tells them these items:

the vulnerability or the incident
where necessary, "any risk mitigation and corrective measures that the users can deploy to mitigate the impact of that vulnerability or incident"

"Where appropriate", the manufacturer gives this information "in a structured, machine-readable format that is easily automatically processable". If the manufacturer does not tell the users "in a timely manner", the notified CSIRTs designated as coordinators are permitted to give the information to the users. They can do this "when considered to be proportionate and necessary for preventing or mitigating the impact of that vulnerability or incident".

Article 14(8) applies from 11 September 2026, also to products placed on the market before 11 December 2027 (Articles 69(3) and 71(2)).

The Commission guidance tells manufacturers to apply Article 14(8) "in a risk-based and proportionate manner". The guidance also tells them that this information "does not imply that such information must be made public or disclosed indiscriminately" (paragraph 220).

Article 17(2) of the CRA gives a different decision to the CSIRT designated as coordinator of "the relevant Member State". That CSIRT designated as coordinator is permitted to tell "the public" about the incident, or to "require the manufacturer to do so", "after consulting the manufacturer concerned and, where appropriate, in cooperation with ENISA". This applies in one of these conditions:

"public awareness is necessary to prevent or mitigate a severe incident having an impact on the security of the product with digital elements or to handle an ongoing incident"
"disclosure of the incident is otherwise in the public interest"

The manufacturer must tell "the public" in Article 17(2) only when that CSIRT designated as coordinator tells it to do this. Article 17 applies from 11 December 2027 (Article 71(2)).

A different obligation is in Annex I, Part II, point (4): to "share and publicly disclose information about fixed vulnerabilities". It applies from 11 December 2027. See Fixed vulnerabilities.

Open-source software stewards — Article 24

Article 24 of the CRA gives the obligations of open-source software stewards. An open-source software steward is a legal person, other than a manufacturer, that "has the purpose or objective of systematically providing support on a sustained basis for the development of specific products with digital elements, qualifying as free and open-source software and intended for commercial activities, and that ensures the viability of those products" (Article 3(14)).

The steward must "put in place and document in a verifiable manner a cybersecurity policy" (Article 24(1)). In Article 24(1), the policy must do these tasks:

"foster the development of a secure product with digital elements as well as an effective handling of vulnerabilities by the developers of that product"
"foster the voluntary reporting of vulnerabilities as laid down in Article 15 by the developers of that product"
"take into account the specific nature of the open-source software steward and the legal and organisational arrangements to which it is subject"
"in particular, include aspects related to documenting, addressing and remediating vulnerabilities"
"promote the sharing of information concerning discovered vulnerabilities within the open-source community"

The steward must cooperate with the market surveillance authorities, "at their request", "with a view to mitigating the cybersecurity risks posed by a product with digital elements qualifying as free and open-source software". On a reasoned request, the steward must give the authority the "documentation" of the policy, "in a language which can be easily understood by that authority", "in paper or electronic form" (Article 24(2)).

Article 24(3) applies parts of Article 14 to stewards:

Article 14(1) applies "to the extent that they are involved in the development of the products with digital elements".
Article 14(3) and (8) apply "to the extent that severe incidents having an impact on the security of products with digital elements affect network and information systems provided by the open-source software stewards for the development of such products".

Article 24 applies from 11 December 2027, because Article 71(2) gives a different date only to Article 14 and to Chapter IV. The Commission services FAQ and ENISA give the same date for Article 24(3) (FAQ 5.5). In Article 64(10)(b), the fines of paragraphs 3 to 9 do not apply to “any infringement of this Regulation by open-source software stewards”. See the penalties of the CRA.

COM(2025) 837 and a single-entry point

The Commission’s COM(2025) 837 of 19 November 2025 (Digital Omnibus) has changes to Directive (EU) 2022/2555 (NIS2). COM(2025) 837 is not law as of October 2026. For procedure 2025/0360(COD), the Legislative Observatory of the European Parliament shows "Awaiting committee decision".

COM(2025) 837 adds these provisions to NIS2:

Article 23a tells ENISA to "develop and maintain a single-entry point" for incident reports in different Union legal acts. In Article 23a(1), "ENISA may ensure that the single-entry point builds on the single reporting platform established under that Regulation", that is, the CRA.
Article 23(12) is about a manufacturer that notifies a severe incident in Article 14(3) of the CRA. If that notification "contains relevant information as required under paragraph 4 of this Article", the notification "shall constitute reporting of information under paragraph 4 of this Article", that is, NIS2 Article 23(4).

COM(2025) 837 does not change Regulation (EU) 2024/2847. The time limits of Article 14 of the CRA stay the same.

Economic operators and open-source software stewards

Article 3 of the CRA gives these definitions of economic operators and open-source software stewards:

Person	Article 3	Point
Manufacturer	"a natural or legal person who develops or manufactures products with digital elements or has products with digital elements designed, developed or manufactured, and markets them under its name or trademark, whether for payment, monetisation or free of charge"	3(13)
Authorized representative	"a natural or legal person established within the Union who has received a written mandate from a manufacturer to act on its behalf in relation to specified tasks"	3(15)
Importer	"a natural or legal person established in the Union who places on the market a product with digital elements that bears the name or trademark of a natural or legal person established outside the Union"	3(16)
Distributor	"a natural or legal person in the supply chain, other than the manufacturer or the importer, that makes a product with digital elements available on the Union market without affecting its properties"	3(17)
Open-source software steward	See Open-source software stewards.	3(14)

An economic operator is "the manufacturer, the authorised representative, the importer, the distributor, or other natural or legal person who is subject to obligations in relation to the manufacture of products with digital elements or to the making available of products with digital elements on the market in accordance with this Regulation" (Article 3(12)). Open-source software stewards are a different category. Chapter II of the CRA has the name "Obligations of economic operators and provisions in relation to free and open-source software".

The CRA attaches obligations to each economic operator and to stewards (Articles 13, 14, and 18 to 24). It does not make them record a decision about which economic operator they are. One person can be more than one type of economic operator, and the type can be different for each product. In Modulos, ORF-468 records if the CRA applies to each product and all the Organization’s "roles", with open-source software stewards included. See Decisions before you add the Frameworks.

Persons considered to be a manufacturer — Articles 21 and 22

Article 21 of the CRA applies to an importer or a distributor in one of these conditions:

It "places a product with digital elements on the market under its name or trademark".
It "carries out a substantial modification of a product with digital elements already placed on the market".

In these conditions, the importer or distributor "shall be considered to be a manufacturer", and it is subject to Articles 13 and 14.

In Article 22(1), a different person is also considered to be a manufacturer: "a natural or legal person, other than the manufacturer, the importer or the distributor, that carries out a substantial modification of a product with digital elements and makes that product available on the market". In Article 22(2), that person is subject to Articles 13 and 14 "for the part of the product with digital elements that is affected by the substantial modification". If "the substantial modification has an impact on the cybersecurity of the product with digital elements as a whole", that person is subject to them "for the entire product".

These two Articles apply from 11 December 2027 (Article 71(2)). For substantial modification, see Placing on the market and substantial modification.

Authorized representatives, importers, and distributors — Articles 18 to 20

Articles 18 to 20 of the CRA give the obligations of authorized representatives, importers, and distributors. These obligations apply from 11 December 2027.

Authorized representatives — Article 18

In Article 18(1) of the CRA, a manufacturer "may, by a written mandate, appoint an authorised representative". These obligations of the manufacturer are not part of the mandate: Article 13(1) to (11), the first subparagraph of Article 13(12), and Article 13(14) (Article 18(2)).

The authorized representative must do the tasks in the mandate. It must give a copy of the mandate to the market surveillance authorities "upon request". The mandate must let the authorized representative do all these tasks, and it can include more tasks (Article 18(3)):

Keep the EU declaration of conformity and technical documentation available to market surveillance authorities for the period specified below.
On a reasoned request from a market surveillance authority, give that authority "all the information and documentation necessary to demonstrate the conformity of the product with digital elements".
Cooperate with the market surveillance authorities, "at their request", "on any action taken to eliminate the risks posed by a product with digital elements covered by the authorised representative's mandate".

Importers — Article 19

Article 19 of the CRA gives these obligations to importers:

Products in conformity — The importer must place on the market only products with digital elements that comply with Annex I, Part I. It must do this only where the manufacturer’s vulnerability handling processes comply with Annex I, Part II (Article 19(1)).
Checks before the placing on the market — The importer must make sure that "the appropriate conformity assessment procedures as referred to in Article 32 have been carried out by the manufacturer" and that "the manufacturer has drawn up the technical documentation". It must also make sure that the product has the CE marking and comes with the EU declaration of conformity. It must also make sure that the product comes with the Annex II information and instructions to the user, "in a language which can be easily understood by users and market surveillance authorities". It must also make sure that "the manufacturer has complied with the requirements set out in Article 13(15), (16) and (19)". The importer must be able to give "the necessary documents proving the fulfilment of the requirements set out in this Article" (Article 19(2)).
Products not in conformity — Sometimes the importer "considers or has reason to believe" that the product or the manufacturer’s "processes" are not in conformity with the CRA. In that condition, the importer "shall not place the product on the market until that product or the processes put in place by the manufacturer have been brought into conformity with this Regulation". If the product "presents a significant cybersecurity risk", the importer must tell the manufacturer and the market surveillance authorities (Article 19(3)).
Risks from other causes — If the importer has reason to believe that a product "may present a significant cybersecurity risk in light of non-technical risk factors", it must tell the market surveillance authorities (Article 19(3)).
Contact information — The importer must "indicate their name, registered trade name or registered trademark, the postal address, email address or other digital contact as well as, where applicable, the website at which they can be contacted on the product with digital elements or on its packaging or in a document accompanying the product with digital elements". The contact information must be "in a language easily understood by users and market surveillance authorities" (Article 19(4)).
After the placing on the market — Sometimes the importer knows or has reason to believe that a product that it placed on the market is not in conformity with the CRA. In that condition, the importer must "immediately take the corrective measures necessary to ensure that the product with digital elements is brought into conformity with this Regulation, or to withdraw or recall the product, if appropriate" (Article 19(5)).
Vulnerabilities and risks — When it becomes aware of a vulnerability in the product, the importer must tell the manufacturer without undue delay. If the product "presents a significant cybersecurity risk", the importer must immediately tell the market surveillance authorities of the Member States where it made the product available. It gives "details, in particular, of non-compliance and of any corrective measures taken" (Article 19(5)).
Information to authorities — A market surveillance authority can send a reasoned request to the importer. The importer must then give it "all the information and documentation" necessary to show conformity with Annex I, Part I, for the product and with Annex I, Part II, for the manufacturer’s vulnerability handling processes. The importer gives them "in paper or electronic form", "in a language that can be easily understood by that authority". The importer must also cooperate with that authority, "at its request", "on any measures taken to eliminate the cybersecurity risks posed by a product with digital elements, which they have placed on the market" (Article 19(7)).
End of operations — Sometimes the importer becomes aware that the manufacturer stopped its operations and, as a result, cannot comply with the CRA. In that condition, the importer must tell "the relevant market surveillance authorities". It must also tell the users of the products placed on the market, "by any means available and to the extent possible" (Article 19(8)).

For the records of the importer (Article 19(6)), see Information to authorities and records.

Distributors — Article 20

Article 20 of the CRA tells a distributor to "act with due care in relation to the requirements set out in this Regulation" when it makes a product with digital elements available on the market (Article 20(1)).

Before the distributor makes a product available on the market, it must "verify" these items (Article 20(2)):

The product has the CE marking.
"the manufacturer and the importer have complied with the obligations set out in Article 13(15), (16), (18), (19) and (20) and Article 19(4), and have provided all necessary documents to the distributor"

The distributor also has these obligations:

Products not in conformity — Sometimes the distributor "considers or has reason to believe", "on the basis of information in its possession", that the product or the manufacturer’s "processes" are not in conformity with Annex I. In that condition, the distributor must not make the product available on the market until they are in conformity with the CRA. If the product "poses a significant cybersecurity risk", the distributor must tell the manufacturer and the market surveillance authorities without undue delay (Article 20(3)).
Products made available — Article 20(4) is about a product that the distributor made available, or the "processes put in place by its manufacturer". The distributor knows or has reason to believe that one of these is not in conformity with the CRA, "on the basis of information in their possession". In that condition, the distributor must make sure that "the corrective measures necessary to bring that product with digital elements or the processes put in place by its manufacturer into conformity, or to withdraw or recall the product, if appropriate, are taken" (Article 20(4)).
Vulnerabilities and risks — When it becomes aware of a vulnerability in the product, the distributor must tell the manufacturer without undue delay. If the product "presents a significant cybersecurity risk", the distributor must immediately tell the market surveillance authorities of the Member States where it made the product available. The distributor gives "details, in particular, of the non-compliance and of any corrective measures taken" (Article 20(4)).
Information to authorities — A market surveillance authority can send a reasoned request to the distributor. The distributor must then give it "all the information and documentation" necessary to show the conformity of the product and of the "processes" of its manufacturer with the CRA. The distributor gives them "in paper or electronic form", "in a language that can be easily understood by that authority". The distributor must also cooperate with that authority, "at its request", "on any measures taken to eliminate the cybersecurity risks posed by a product with digital elements which they have made available on the market" (Article 20(5)).
End of operations — Sometimes the distributor becomes aware, "on the basis of information in its possession", that the manufacturer stopped its operations and, as a result, cannot comply with the CRA. In that condition, the distributor must tell "the relevant market surveillance authorities" without undue delay. The distributor must also tell the users of the products placed on the market without undue delay, "by any means available and to the extent possible" (Article 20(6)).

Information to authorities and records

The CRA tells each economic operator to give information to market surveillance authorities, to cooperate with them, and to keep records. These obligations apply from 11 December 2027.

In Article 13(21), a manufacturer that knows or has reason to believe that the product or its "processes" are not in conformity with Annex I must "immediately take the corrective measures necessary". See corrective measures.

The manufacturer has these obligations to the authorities:

Information to authorities — A market surveillance authority can send a reasoned request to the manufacturer. The manufacturer must then give it "all the information and documentation" necessary to show the conformity of the product and of its "processes" with Annex I. The manufacturer gives them "in a language which can be easily understood by that authority", "in paper or electronic form" (Article 13(22)).
Risk measures — At the authority’s "request", the manufacturer must cooperate "on any measures taken to eliminate the cybersecurity risks posed by the product with digital elements which they have placed on the market" (Article 13(22)).
End of operations — A manufacturer that stops its operations and, as a result, cannot comply with the CRA must tell "the relevant market surveillance authorities" "before the cessation of operations takes effect". The manufacturer must also tell "the users of the relevant products with digital elements placed on the market" "before the cessation of operations takes effect". It must do this "by any means available and to the extent possible" (Article 13(23)).

Article 53 gives market surveillance authorities access to data "where necessary to assess the conformity of products with digital elements and the processes put in place by their manufacturers with the essential cybersecurity requirements set out in Annex I". The authorities get this access on a reasoned request. The access is to "the data, in a language easily understood by them, required to assess the design, development, production and vulnerability handling of such products, including related internal documentation of the relevant economic operator".

When a market surveillance authority must "carry out an evaluation" of a product in Article 54(1), "the relevant economic operators shall cooperate with the market surveillance authority as necessary".

Articles 13(13), 13(18), 18(3)(a), and 19(6) use the same record period. It is a minimum of 10 years after the placing on the market of the product, or the support period, "whichever is longer". The CRA tells each economic operator to keep these records:

Economic operator	Record	Period	Article
Manufacturer	The technical documentation and the EU declaration of conformity, available to the market surveillance authorities. See Technical documentation.	10 years or the support period	13(13)
Manufacturer	The Annex II information and instructions to the user, available to users and market surveillance authorities. See Product identification and information to users.	10 years or the support period	13(18)
Authorized representative	The EU declaration of conformity and the technical documentation, available to the market surveillance authorities. The mandate must let the authorized representative do this.	10 years or the support period	18(3)(a)
Importer	A copy of the EU declaration of conformity, available to the market surveillance authorities. The importer must also make sure that the technical documentation is available to these authorities "upon request".	10 years or the support period	19(6)
Each economic operator	"On request", "the name and address of any economic operator who has supplied them with a product with digital elements" and, "where available", "the name and address of any economic operator to whom they have supplied a product with digital elements".	10 years after the economic operator got the product, and 10 years after it supplied the product	23

The distributor has no record period other than the period in Article 23.