Art. 3(17)An importer is any natural or legal person established in the Union who places on the market a product with digital elements that bears the name or trademark of a natural or legal person established outside the Union.
Before placing a product with digital elements on the EU market, importers must verify that the manufacturer has carried out the appropriate conformity assessment, drawn up technical documentation, affixed the CE marking, and made the EU declaration of conformity or declaration of performance available.
Where an importer considers or has reason to believe that a product with digital elements is not in conformity with the essential cybersecurity requirements, the importer must not place the product on the market until conformity is achieved.
Importers must indicate their name, registered trade name or trademark, postal address, and where available their website or email address, on the product itself, on its packaging, or in a document accompanying the product.
While a product with digital elements is under the importer's responsibility, the importer must ensure that storage and transport conditions do not jeopardise its conformity with the essential cybersecurity requirements.
If an importer learns that a product they have placed on the market is not in conformity, they must immediately take corrective action — including withdrawal or recall if necessary. Where the product poses a significant cybersecurity risk, the importer must immediately notify the relevant national competent authority.
Importers must keep a copy of the EU declaration of conformity or declaration of performance for 10 years after the product is placed on the market, and ensure that technical documentation can be made available to market surveillance authorities upon request.
Upon a reasoned request from a competent authority, importers must provide all information and documentation — in paper or electronic form — necessary to demonstrate the conformity of a product with digital elements. They must also cooperate on any corrective action required.