Obligations of importers 1. Importers shall place on the market only products with digital elements that comply with the essential cybersecurity requirements set out in Part I of Annex I and where the processes put in place by the manufacturer comply with the essential cybersecurity requirements set out in Part II of Annex I.
How to satisfy it: Importers carry a two-sided check: the product against Annex I Part I and the manufacturer's processes against Part II. Under Articles 21 and 22 an importer can inherit full manufacturer obligations.
2. Before placing a product with digital elements on the market, importers shall ensure that: (a) the appropriate conformity assessment procedures as referred to in Article 32 have been carried out by the manufacturer; (b) the manufacturer has drawn up the technical documentation; (c) the product with digital elements bears the CE marking referred to in Article 30 and is accompanied by the EU declaration of conformity referred to in Article 13(20) and the information and instructions to the user as set out in Annex II in a language which can be easily understood by users and market surveillance authorities; (d) the manufacturer has complied with the requirements set out in Article 13(15), (16) and (19). For the purposes of this paragraph, importers shall be able to provide the necessary documents proving the fulfilment of the requirements set out in this Article.
How to satisfy it: The concrete pre-market checklist, and the word that matters is ENSURE. The closing sentence requires the importer to be able to PRODUCE the documents proving each point, so believing the manufacturer did the work is not the standard. Point (d) reaches back into Article 13(15), (16) and (19), which are the marking, contact-details and support-period duties, and those are the ones a distributor will later verify against you.
3. Where an importer considers or has reason to believe that a product with digital elements or the processes put in place by the manufacturer are not in conformity with this Regulation, the importer shall not place the product on the market until that product or the processes put in place by the manufacturer have been brought into conformity with this Regulation. Furthermore, where the product with digital elements presents a significant cybersecurity risk, the importer shall inform the manufacturer and the market surveillance authorities to that effect. Where an importer has reason to believe that a product with digital elements may present a significant cybersecurity risk in light of non-technical risk factors, the importer shall inform the market surveillance authorities to that effect. Upon receipt of such information, the market surveillance authorities shall follow the procedures referred to in Article 54(2).
How to satisfy it: Two different triggers with two different recipients. Reason to believe the product or the manufacturer's processes are non-conforming stops you placing it at all. A SIGNIFICANT cybersecurity risk additionally obliges you to tell the manufacturer and the market surveillance authorities. The second subparagraph is easy to miss: a significant risk arising from NON-TECHNICAL risk factors goes to the authorities even where the product itself checks out.
4. Importers shall indicate their name, registered trade name or registered trademark, the postal address, email address or other digital contact as well as, where applicable, the website at which they can be contacted on the product with digital elements or on its packaging or in a document accompanying the product with digital elements. The contact details shall be in a language easily understood by users and market surveillance authorities.
How to satisfy it: Identification on the product, its packaging, or a document accompanying it, in a language users and authorities easily understand. Cheap to satisfy and cheap to fail: a distributor is required by Article 20(2)(b) to verify you did it, so an omission surfaces downstream rather than in your own audit.
5. Importers shall, further to a reasoned request from a market surveillance authority, provide it with all the information and documentation, in paper or electronic form, necessary to demonstrate the conformity of the product with digital elements with the essential cybersecurity requirements set out in Part I of Annex I as well as of the processes put in place by the manufacturer with the essential cybersecurity requirements set out in Part II of Annex I in a language that can be easily understood by that authority.
How to satisfy it: A reasoned request from a market surveillance authority is answerable in a language THAT AUTHORITY easily understands, which in practice means the language of the Member State asking. The obligation covers both halves: the product against Annex I Part I and the manufacturer's processes against Part II, so an importer who holds only product documentation cannot answer it.
Every quoted requirement on this page is verbatim Official Journal text. The surrounding guidance is Legalithm’s commentary and is not regulation. This page states the obligation and its legal basis; it is not legal advice, and the corpus has not been reviewed by counsel.
