Players under your own name: how that makes you a maker

In the digital signage industry it is common not to build players yourself. An integrator orders devices from a contract manufacturer in Asia, has its own logo printed on them, installs its own software and sells the result as its own product. For Regulation (EU) 2024/2847, the Cyber Resilience Act, this is not a detail. It allocates duties by role, and putting your own label on a device changes your role.

Three roles in the supply chain

Article 3 of the regulation distinguishes three economic operators.

A manufacturer is anyone who develops or manufactures products with digital elements, or has them designed, developed or manufactured, and markets them under its own name or trademark.

An importer is anyone established in the Union who places on the Union market a product bearing the name or trademark of a company established outside the Union.

A distributor is anyone in the supply chain who makes a product available without affecting its properties and is neither the manufacturer nor the importer.

What importers have to check

Anyone importing players under the foreign manufacturer's brand must, under Article 19, ensure before placing them on the market that the manufacturer has carried out the conformity assessment and drawn up the technical documentation, that the product bears the CE marking, and that the declaration of conformity and the instructions are enclosed in a language users can easily understand. The importer must put its own name, postal address and a digital contact on the product, the packaging or the accompanying documents. It keeps the declaration of conformity available to market surveillance authorities for at least ten years, or for the support period if that is longer.

If the importer learns of a vulnerability, it informs the manufacturer without undue delay. If the manufacturer ceases operations, the importer must inform the market surveillance authorities and, as far as possible, the users.

What distributors have to check

For distributors the list is shorter. Article 20 demands due care. Before making a product available the distributor verifies that the CE marking is present and that manufacturer and importer have supplied their details and the necessary documents. If it has reason to believe the product does not meet the requirements, it must not make it available until that has been remedied.

The change of role

Article 21 is the decisive sentence for the industry. An importer or distributor is considered a manufacturer and is subject to the manufacturer's obligations where it places a product on the market under its own name or trademark, or carries out a substantial modification of a product already placed on the market.

The company's own logo on the housing is therefore enough. Anyone selling that way owes the duties of Articles 13 and 14: security requirements over the life cycle, vulnerability handling, reporting, documentation. Pointing to the contract manufacturer no longer helps.

The regulation defines a substantial modification as a change after placing on the market that affects compliance with the security requirements or alters the intended purpose. Article 22 extends this to anyone who makes such a change and makes the product available, even if they are neither importer nor distributor.

The timetable

Under Article 71 the regulation applies from 11 December 2027. The reporting obligations of Article 14 have applied since 11 September 2026.

What to clarify now

1. Under whose name does the device appear in the offer and on the rating plate?
2. Which documents does the contract manufacturer supply, and are they sufficient for a declaration of conformity?
3. Who delivers security updates for the device firmware, and for how long is that contractually promised?
4. Who receives vulnerability reports?

Those who raise these questions with their supplier only at the end of 2027 will be negotiating against the clock.

This article reflects the text of the regulation and is not legal advice.