Legalithm logo

Cyber Resilience Act · Article 23

Identification of economic operators

Binds
economic operators
Applies from
Evidence
record

Article 23(1): Identification of economic operators

all operators · Article 23(1)

1. Economic operators shall, on request, provide the market surveillance authorities with the following information: (a) the name and address of any economic operator who has supplied them with a product with digital elements; (b) where available, the name and address of any economic operator to whom they have supplied a product with digital elements.

How to satisfy it: Addressed to ECONOMIC OPERATORS generally, so it binds manufacturers, importers, distributors and authorised representatives alike. That is why this row carries no role dimension: scoping it to one role would hide it from the others. Both directions are in scope - who supplied you, and who you supplied - with the downstream leg qualified by 'where available'.

Article 23(1) on EUR-Lex · as of 2026-08-13 · Regulation (EU) 2024/2847

Article 23(2): Identification of economic operators

all operators · Article 23(2)

2. Economic operators shall be able to present the information referred to in paragraph 1 for 10 years after they have been supplied with the product with digital elements and for 10 years after they have supplied the product with digital elements.

How to satisfy it: Ten years in each direction, counted separately: from when you were supplied, and from when you supplied. This is cheap to satisfy prospectively and close to impossible to reconstruct afterwards, which makes it one of the few CRA duties worth acting on well before December 2027.

Article 23(2) on EUR-Lex · as of 2026-08-13 · Regulation (EU) 2024/2847

Every quoted requirement on this page is verbatim Official Journal text. The surrounding guidance is Legalithm’s commentary and is not regulation. This page states the obligation and its legal basis; it is not legal advice, and the corpus has not been reviewed by counsel.