Art. 3(18)A distributor is any natural or legal person in the supply chain, other than the manufacturer or importer, who makes a product with digital elements available on the Union market without altering its properties.
When making a product with digital elements available on the market, distributors must act with due care and verify that the product bears the CE marking, is accompanied by the required documentation and information, and that the manufacturer and importer (if applicable) have complied with their labelling and identification obligations.
Where a distributor considers or has reason to believe that a product is not in conformity with the CRA's essential requirements, the distributor must not make the product available on the market until conformity is achieved, and must notify the manufacturer and, where applicable, the market surveillance authority.
Distributors must ensure that, while a product with digital elements is under their responsibility, storage and transport conditions do not jeopardise its conformity with the essential cybersecurity requirements.
If a distributor learns that a product they have made available on the market is not in conformity, they must immediately take corrective action including withdrawal or recall if necessary. Where the product poses a significant cybersecurity risk, they must immediately notify the relevant national market surveillance authority.
Upon a reasoned request from a competent authority, distributors must provide all information and documentation necessary to demonstrate the conformity of a product, and cooperate on any corrective action required by that authority.