Obligations of distributors 1. When making a product with digital elements available on the market, distributors shall act with due care in relation to the requirements set out in this Regulation.
How to satisfy it: Due care is the standard, and paragraph 2 names the exact manufacturer and importer paragraphs a distributor must verify. Record what was checked and when.
2. Before making a product with digital elements available on the market, distributors shall verify that: (a) the product with digital elements bears the CE marking; (b) the manufacturer and the importer have complied with the obligations set out in Article 13(15), (16), (18), (19) and (20) and Article 19(4), and have provided all necessary documents to the distributor.
How to satisfy it: Verification, not assurance. The paragraph names the exact provisions to check, Article 13(15), (16), (18), (19) and (20) and Article 19(4), and adds that the documents must actually have been provided to you. A distributor with no copy of the EU declaration of conformity has not satisfied this, whatever the manufacturer says.
3. Where a distributor considers or has reason to believe, on the basis of information in its possession, that a product with digital elements or the processes put in place by the manufacturer are not in conformity with the essential cybersecurity requirements set out in Annex I, the distributor shall not make the product with digital elements available on the market until that product or the processes put in place by the manufacturer have been brought into conformity with this Regulation. Furthermore, where the product with digital elements poses a significant cybersecurity risk, the distributor shall inform, without undue delay, the manufacturer and the market surveillance authorities to that effect.
How to satisfy it: The threshold is lower than it looks: reason to believe ON THE BASIS OF INFORMATION IN ITS POSSESSION. That includes what a supplier told you and what you read in an advisory. Where the risk is significant, the manufacturer and the authorities are told WITHOUT UNDUE DELAY, which is a shorter clock than the paragraph's calm tone suggests.
4. Distributors who know or have reason to believe, on the basis of information in their possession, that a product with digital elements, which they have made available on the market, or the processes put in place by its manufacturer are not in conformity with this Regulation shall make sure that the corrective measures necessary to bring that product with digital elements or the processes put in place by its manufacturer into conformity, or to withdraw or recall the product, if appropriate, are taken. Upon becoming aware of a vulnerability in the product with digital elements, distributors shall inform the manufacturer without undue delay about that vulnerability. Furthermore, where the product with digital elements presents a significant cybersecurity risk, distributors shall immediately inform the market surveillance authorities of the Member States in which they have made the product with digital elements available on the market to that effect, giving details, in particular, of the non-compliance and of any corrective measures taken.
How to satisfy it: The duty most distributors do not know they have. Beyond corrective measures, withdrawal and recall, the second subparagraph obliges a distributor who becomes AWARE OF A VULNERABILITY to inform the manufacturer without undue delay, and where the risk is significant to immediately inform the market surveillance authorities of every Member State where the product was made available, with details of the non-compliance and the measures taken. That is a reporting duty on a party who did not build the product.
5. Distributors shall, further to a reasoned request from a market surveillance authority, provide all the information and documentation, in paper or electronic form, necessary to demonstrate the conformity of the product with digital elements and the processes put in place by its manufacturer with this Regulation in a language that can be easily understood by that authority. They shall cooperate with that authority, at its request, on any measures taken to eliminate the cybersecurity risks posed by a product with digital elements which they have made available on the market.
How to satisfy it: Two obligations in one paragraph, and the second outlives the first. Provide the information and documentation on a reasoned request, and then COOPERATE on any measures taken to eliminate the risk. Cooperation is open-ended and continues after the paperwork is sent.
Every quoted requirement on this page is verbatim Official Journal text. The surrounding guidance is Legalithm’s commentary and is not regulation. This page states the obligation and its legal basis; it is not legal advice, and the corpus has not been reviewed by counsel.
