Legalithm logo

Cyber Resilience Act · Article 22

Other cases in which obligations of manufacturers apply

Binds
substantial modifier
Applies from
Evidence
process, record

Article 22(1): Other cases in which obligations of manufacturers apply

substantial modifier · Article 22(1)

1. A natural or legal person, other than the manufacturer, the importer or the distributor, that carries out a substantial modification of a product with digital elements and makes that product available on the market, shall be considered to be a manufacturer for the purposes of this Regulation.

How to satisfy it: The catch-all for anyone who is neither the manufacturer, the importer nor the distributor. A systems integrator, a reseller who reflashes firmware, or a service company that ships a modified build all land here once they make the modified product available on the market.

Article 22(1) on EUR-Lex · as of 2026-08-13 · Regulation (EU) 2024/2847

Article 22(2): Other cases in which obligations of manufacturers apply

substantial modifier · Article 22(2)

2. The person referred to in paragraph 1 of this Article shall be subject to the obligations set out in Articles 13 and 14 for the part of the product with digital elements that is affected by the substantial modification or, if the substantial modification has an impact on the cybersecurity of the product with digital elements as a whole, for the entire product.

How to satisfy it: The scope limit that Article 21 does not have. A person caught by paragraph 1 takes on Articles 13 and 14 only FOR THE PART affected by the substantial modification, unless the modification affects the cybersecurity of the product as a whole, in which case it is the entire product. Establishing which of the two applies is the first piece of evidence to produce, not the last.

Article 22(2) on EUR-Lex · as of 2026-08-13 · Regulation (EU) 2024/2847

Every quoted requirement on this page is verbatim Official Journal text. The surrounding guidance is Legalithm’s commentary and is not regulation. This page states the obligation and its legal basis; it is not legal advice, and the corpus has not been reviewed by counsel.