Glossary A–ZLetter M
Manufacturer (under the CRA)
Under the Cyber Resilience Act, a manufacturer is anyone who develops or manufactures products with digital elements, or has them developed or manufactured, and markets them under its own name or trademark.
Most of the regulation’s obligations fall on the manufacturer.
In screen networks, these are mainly suppliers of media players, displays with a built-in operating system and player software. But someone who builds nothing can also become a manufacturer: an importer or distributor is treated as a manufacturer if it places a product on the market under its own name or trademark, or makes a substantial modification to it. It is common in the industry to order players from a contract manufacturer and sell them with one’s own logo and software.
The manufacturer role brings obligations such as security requirements over the support period, vulnerability handling, reporting, technical documentation and a declaration of conformity. An operator who only buys and uses devices is generally not a manufacturer. System integrators should clarify their role for each product before the remaining obligations apply in December 2027. This explanation is not legal advice.