CRA importer & distributor 2027 – CE certificate, white label and sales ban | Word/PDF/Excel

Do you import or sell connected products, smart devices, or software in Sweden? The CRA imposes specific compliance obligations on importers and distributors – and if you sell under your own name, use your own brand, or substantially modify a product, you may also incur manufacturer liability. This practical document package helps you verify CE and supplier evidence, assess the chain of responsibility, and make traceable decisions to approve, investigate, or stop a product before sale.

Quick facts: 15 customer files – 7 Word documents, 7 searchable PDFs, and 1 Excel register with nine tabs. Five Swedish operational templates, a Swedish user guide, and an English guide to the Swedish operational templates. Digital ZIP · Swedish/EU law · product version 1.0.

Who is the package designed for?

For Swedish importers, wholesalers, distributors, and e-commerce businesses that place or provide products with digital elements on the EU market, including companies that sell under their own brand. This may include suppliers of smart home products, connected sensors, digital control units, and software. The CRA's actual scope and any exemptions must always be assessed on a product-by-product basis; certain product sectors are covered by specific Union rules.

The files in detail

Nine Excel tabs with decision indicators

Overview, Products, Actor Roles, Importer Evidence, Distributor, White Label, Deviations, Actions, Read Me. The overview shows, among other things, unclear actor roles, missing CE marking, missing EU declaration, open white label issues, blocked release decisions, open deviations, and blocked/delayed actions.

All eight indicators have been tested with synthetic cases and then cleared. An empty register shows zero but does not mean that anything is approved. Simply enter internal product/evidence IDs in the Excel file; vulnerability details and confidential supplier documents should be kept in a secure system.

What does the Cyber Resilience Act say?

Article 19 – importers: before a product with digital elements is placed on the market, the importer must ensure, among other things, the manufacturer's relevant conformity assessment, technical documentation, CE marking, EU declaration of conformity, information/instructions under Annex II, and certain manufacturer requirements. The importer's own identification and contact details are also regulated. For importers retaining the EU declaration, the period is at least 10 years or the support period, whichever is longer. Read CRA Article 19.

Article 20 – distributors: the distributor must check the CE marking and stated documentation/identification before the product is provided. If a deficiency is known or suspected, the product may in some cases not be offered until conformity is ensured. A significant cybersecurity risk may require that the manufacturer and relevant market surveillance authorities be notified. Read CRA Article 20.

Article 21 – white label and substantial modification: if an importer or distributor places the product on the market under its own name/brand or makes a substantial modification to a product already on the market, the actor may be considered a manufacturer in prescribed cases and be subject to Articles 13 and 14. This is not a voluntary contractual choice that can be negotiated away with the supplier. Read CRA Article 21.

Important dates: The CRA's main requirements will apply from 11 December 2027. The manufacturer's reporting obligations under Article 14 apply from 11 September 2026. For products placed on the EU market before 11 December 2027, there are special transitional provisions in Article 69, but Article 14 also applies in relevant cases. EU Commission CRA overview.

How you work with the document package

1. Describe the product model, software version, EU market event, and assess applicability in document 01.
2. Determine whether your organization is an importer, distributor, or must be assessed as a manufacturer.
3. Collect actual CE/EU declaration and manufacturer evidence and record internal evidence IDs.
4. Perform a special assessment if you sell under your own brand, change firmware, or substantially modify the product.
5. Make a documented decision: ready for the next control step, investigate further, or block sales.
6. In case of deviations: assess authority notification, manufacturer contact, correction, or recall according to your actual role.
7. Follow up on the supplier, support period, and remaining evidence in Excel. Archive sensitive originals in secure document management.

Frequently Asked Questions

Does a reseller become a manufacturer when the product receives our brand?

This may follow from Article 21 when the product is placed on the market under the reseller's own name or brand. The actual market event must be assessed.

Is a CE symbol from the factory sufficient?

No. For an importer, relevant assurances, documents, and checks under Article 19 are also required. A symbol without the correct product and manufacturer evidence is insufficient.

Do the same requirements apply if the product was already sold before 2027?

Not automatically. Assess Article 69 on transition, substantial modification, and the special application of Article 14.

Can an importer agreement transfer all liability to the factory?

No. Contractual clauses can regulate the division of work but do not change who is considered an importer, distributor, or manufacturer under EU law.

Is the product a CRA certificate or a valid CE declaration?

No. It contains no test results, technical verification, or authority decision. It is a structured operational and evidence basis.

Are the PDF files digitally fillable?

No. They are searchable and printable. Use DOCX and XLSX for editing.

Are the operational templates bilingual?

The five operational templates and Excel are in Swedish. An English-language user guide is included to support English-speaking employees.

Related Mallbutiken products

CRA Compliance – risk assessment, SBOM, and incident reporting is a broader package for manufacturers' CRA work. CRA support period 2027 covers security updates and the support lifecycle. This product is limited to the importer/distributor's evidence control and white label liability.

Legal review level and file format

Version 1.0, AI-assisted source check 12 November 2026, jurisdiction Sweden/EU. Primary legal sources: Regulation (EU) 2024/2847 Articles 2, 13–14, 19–23, 69, and 71, as well as Annex II; EU Commission guidance. No external legal review, independent technical testing, accredited certification, actual CE assessment, or contact with market surveillance authorities has been carried out. Check current law, product category, and technical documentation with a qualified expert before use. The ZIP customer file is not linked to Digital Products in the draft.