Economic operator

Economic operator is the umbrella term under which the Cyber Resilience Act (CRA) gathers every role that carries obligations for a product with digital elements. Article 3(12) names four of them and then opens the term up to any other natural or legal person subject to obligations in relation to the manufacture of such products or to making them available on the market.

The term creates no obligations of its own. Wherever the Regulation means not one particular role but all of them at once, it speaks of the economic operator, above all in market surveillance and enforcement.

The four named roles

• The Manufacturer develops or manufactures a product, or has it designed, developed or manufactured, and markets it under its own name or trademark. It carries the bulk of the Regulation, Articles 13 and 14.
• The Authorised representative is established in the Union and performs specified tasks for the manufacturer under a written mandate.
• The Importer is established in the Union and places on the market a product bearing the name or trademark of a person established outside the Union.
• The Distributor makes a product available on the Union market without affecting its properties and is neither the manufacturer nor the importer.

The list is not exhaustive. The catch-all clause matters in practice wherever a distribution model does not fit cleanly into one of the four boxes.

Conduct decides the role, not the company sign

Which role a company occupies is settled product by product, not once and for all. Article 21 draws the sharpest consequence: an importer or distributor that places a product on the market under its own name or trademark, or carries out a Substantial modification of a product already placed on the market, is considered to be a manufacturer and becomes subject to Articles 13 and 14.

Article 22 extends the same logic to persons outside the classic supply chain. Anyone who is neither the manufacturer nor the importer nor the distributor, carries out a substantial modification and makes the product available is likewise considered to be a manufacturer under paragraph 1. Under paragraph 2 the obligations in Articles 13 and 14 attach for the part of the product affected by the modification, and for the entire product where the modification bears on its cybersecurity as a whole.

One and the same company can therefore fall into different categories depending on the product. The recitals illustrate this with online marketplaces: a business that only intermediates is not an economic operator under the Regulation at all. One that also distributes is a distributor for those sales. One that sells its own branded products qualifies as a manufacturer.

The addressee of official measures

The practical reason for the umbrella term sits in Articles 54–58. Where a Market surveillance authority has sufficient reason to believe that a product presents a significant cybersecurity risk, it evaluates the product without delay, and the economic operators concerned cooperate as necessary. If it finds non-compliance, it requires the economic operator concerned to take corrective measures within a deadline it prescribes, one that must be appropriate to the nature of the risk.

That demand is therefore not necessarily aimed at the manufacturer but at the operator the authority has in front of it. Under Article 54(4) that operator must ensure the corrective measures cover all affected products it has made available across the Union. If it fails to act within the deadline, provisional measures follow: prohibiting or restricting availability on that national market, withdrawal from the market, or recall.

Article 57 stretches this to products that do comply with the Regulation yet present a significant cybersecurity risk together with a risk to the health or safety of persons, to fundamental rights, to services of essential entities under the NIS 2 Directive, or to other aspects of public interest protection. Here too the addressee is an economic operator rather than a named role.

A counter-example sharpens the line. Article 58 deals with formal non-compliance such as a missing CE marking, an EU declaration of conformity that was never drawn up, or technical documentation that is unavailable or incomplete. There the authority requires the manufacturer to put an end to the non-compliance, not any economic operator.

Article 23: accounting for your own supply chain

Article 23 falls on every economic operator alike, whatever its role, and without any proceedings having to be under way. On request from a market surveillance authority you must give:

• the name and address of any economic operator that supplied you with a product,
• where available, the name and address of any economic operator you supplied with a product.

You must be able to present that information for ten years after being supplied and for ten years after supplying. The Regulation prescribes no particular form, only the result. Anyone running procurement and sales in systems that aggregate or purge records after a few years has a quiet problem here.

What non-compliance costs

Article 64 tiers the fines by the obligation breached. The percentage applies only where the offender is an undertaking and runs on its total worldwide annual turnover for the preceding financial year; whichever of the two figures is higher applies.

• Up to EUR 15 000 000 or 2,5 % for non-compliance with the essential cybersecurity requirements in Annex I and with Articles 13 and 14, the manufacturer duties.
• Up to EUR 10 000 000 or 2 % for Articles 18 to 23, among others, meaning the role-specific duties of authorised representatives, importers and distributors and the supply chain information duty.
• Up to EUR 5 000 000 or 1 % for supplying incorrect, incomplete or misleading information to notified bodies and market surveillance authorities in reply to a request.

In setting the amount, it counts explicitly whether the same or another market surveillance authority has already fined that same economic operator for a similar infringement, along with its size and market share. Open-source software stewards are exempt from the fines under paragraphs 3 to 9 for any infringement of the Regulation, and Article 3(12) does not list them among the economic operators either.

Alongside fines runs the civil route. For infringements by economic operators that harm, or may harm, the collective interests of consumers, Article 65 makes the Representative Actions Directive applicable.

When the obligations bite

The Regulation applies from 11 December 2027. Only two parts come earlier: the reporting obligations in Article 14 apply from 11 September 2026, and the chapter on the notification of conformity assessment bodies, Articles 35 to 51, from 11 June 2026.