Economic operators and their responsibilities
Economic operators
The manufacturer
Carries the bulk of the obligations: design in accordance with the essential requirements, conduct the risk assessment, follow the assessment procedure, compile the technical documentation, draw up the EU declaration of conformity, affix the CE marking, determine and honour the support period, handle vulnerabilities, report, inform users, cooperate with authorities, retain evidence.
A manufacturer is any natural or legal person who develops or manufactures a product, or has it designed, developed or manufactured, and markets it under its own name or trademark, whether for payment or free of charge.
The authorised representative
Any natural or legal person established in the Union holding a written mandate from the manufacturer to act on its behalf. The mandate must at least allow it to keep the technical documentation and the EU declaration of conformity at the disposal of authorities, to provide them with requested information and to cooperate.
A manufacturer established outside the Union must appoint an authorised representative.
The importer
Places only compliant products on the market. Before doing so, it verifies that the assessment procedure was carried out, that the manufacturer compiled the technical documentation, that the CE marking is affixed, that the user information is supplied, and that the contact point appears on the product. It indicates its own details. Where it has reason to believe there is non-compliance or a significant risk, it informs the manufacturer and the authorities.
The distributor
Acts with due care: verifies the presence of the CE marking, the user information and the details of upstream operators. It refrains from making available a product it knows or should know to be non-compliant.
The shift of responsibility
This is the most exposed point for an organisation that resells or customises.
An importer or distributor is deemed to be a manufacturer — and therefore assumes all manufacturer obligations — where it places a product on the market under its own name or trademark, or where it makes a substantial modification to a product already placed on the market.
Direct consequences for your activities:
| Situation | Status | What it entails |
|---|---|---|
| You resell a third-party product under its own brand | Distributor | Documentary checks |
| You resell a third-party product under your brand (white label, OEM) | Manufacturer | Technical documentation, SBOM, CE marking, support period, reporting — everything |
| You embed a third-party product in your solution | Manufacturer of the solution | Same, plus due diligence on the component |
| You substantially modify a third-party product | Manufacturer | Same, and a new assessment |
| You distribute unmodified, under the original brand | Distributor | Documentary checks |
This table must be run against the commercial catalogue before anything else: it usually reveals products nobody realised you were the manufacturer of.
The authorities
| Actor | Role |
|---|---|
| European Commission | Delegated acts (updating Annexes III and IV, mandatory certification of critical products) and implementing acts (common specifications, SBOM format), guidance |
| ENISA | Operates the single reporting platform, contributes to the European vulnerability database, produces technical reports and a biennial trends report |
| Coordinating CSIRTs | Recipients of reports in each Member State, coordinate disclosure, may delay dissemination of a notification on justified grounds |
| Market surveillance authorities | Inspections, requests for technical documentation, testing, injunctions, restrictions, withdrawals, recalls |
| ADCO | Administrative cooperation group of surveillance authorities: coordination, joint activities, coordinated sweeps |
| Notifying authorities | Designate, notify and monitor conformity assessment bodies |
| Notified bodies | Carry out module B, C and H assessments for products that cannot self-assess |
In France
The Regulation leaves the designation of authorities to Member States. In play: ANSSI, whose positioning as a market surveillance authority and CERT-FR as coordinating CSIRT are the best-documented hypotheses, and, where applicable, the administrations competent for product market surveillance.
A page to keep current. National designations and their practical arrangements — desk, exchange format, language — are a standing item in updates. Do not freeze here an organisation that is not yet official.