Cyber Resilience Act importer obligations: what you must check before connected hardware enters the EU

Cyber Resilience Act importer obligations require the EU company that places connected hardware on the market to check, before sale, that the manufacturer completed the conformity assessment, drew up technical documentation, affixed the CE marking and supplied the declaration and security information. Reporting duties already apply, and the full obligations start on 11 December 2027.

For anyone selling servers, switches, routers, firewalls or storage systems into Europe, the Cyber Resilience Act (Regulation (EU) 2024/2847) is the biggest change to product rules in a decade. It adds cybersecurity to the list of things a CE marking promises, next to electrical safety and electromagnetic compatibility. Most of the design work falls on the manufacturer. The checks at the point of entry fall on the importer, and that is where non-EU vendors and their EU buyers tend to get surprised.

This guide explains who counts as the importer, which hardware is covered, what the importer has to verify before the first unit is sold, what happens after a vulnerability is found, and how to prepare shipments now so that nothing gets stuck when the main obligations apply.

Who counts as the importer under the Cyber Resilience Act?

The importer is the person or company established in the EU that places on the Union market a product with digital elements bearing the name or trademark of a manufacturer established outside the Union. If a US or Taiwanese brand ships servers to an EU customer, someone inside the EU takes that role, whether or not they planned to.

That definition matters because the role follows the transaction, whatever the contract calls it. A distributor in Germany that buys switches from a California vendor and resells them is the importer for those units. A Spanish integrator that brings in GPU servers for a client project is the importer for that shipment. When a non-EU seller ships on DDP terms and declares the goods itself, it still needs an EU-established operator to stand behind the product, because EU product law does not accept a company with no presence in the Union as the responsible party.

The Market Surveillance Regulation, Regulation (EU) 2019/1020, already set that principle for CE-marked products: there must be an economic operator established in the Union responsible for each product, and its contact details must appear on the product, the packaging or an accompanying document. The Cyber Resilience Act builds on the same structure. If you already worked through CE marking for IT equipment for the Low Voltage and EMC directives, the importer's place in the chain will look familiar. What changes is the subject of the checks: software, firmware, vulnerability handling and security updates.

For a non-EU company without a subsidiary, the practical answer is to agree in advance who will be the importer. That can be the customer, a distributor, or an Importer of Record that acts as the EU-established party for customs and for product compliance on your behalf.

Which hardware falls under the Cyber Resilience Act?

Almost any hardware that connects to a network or another device is in scope, because the regulation covers every product with digital elements whose intended use includes a data connection. Servers, switches, routers, storage arrays, network cards, power distribution units with management ports and ASIC miners all qualify.

The regulation sorts products into three tiers. Default products, which are the majority, can be self-assessed by the manufacturer. Important products, listed in Annex III, need a stricter route. Critical products, listed in Annex IV, may be required to obtain a European cybersecurity certificate. The tier depends on the product's core functionality, not on a single component inside it.

For high-value IT and network hardware, the Annex III list is the one to read carefully. Class I includes internet-connected routers, modems and switches, physical and virtual network interfaces, network management systems, VPN products, operating systems, and microprocessors, microcontrollers, ASICs and FPGAs with security functions. Class II includes firewalls, intrusion detection and prevention systems, hypervisors and container runtime systems, and tamper-resistant microprocessors and microcontrollers. Annex IV covers hardware devices with security boxes, smart meter gateways and smartcards. Commission Implementing Regulation (EU) 2025/2392 sets out the technical descriptions of each category, which is where borderline cases get decided.

Annex III also changes the paperwork behind the label. A Class I product can be self-assessed only if the manufacturer applies harmonised standards, common specifications or a European cybersecurity certification scheme in full; otherwise a notified body has to be involved. Class II products always need third-party assessment. The rules on notified bodies have applied since 11 June 2026, so manufacturers of firewalls and enterprise routers are already booking those assessments.

There are exclusions. Products covered by sector rules such as medical devices, motor vehicles, civil aviation and marine equipment stay under their own legislation, and spare parts supplied only to replace identical components, made to the same specifications, are excluded. A standard rack server or data center switch, however, is squarely inside the Cyber Resilience Act.

What do Cyber Resilience Act importer obligations require before sale?

Before the first unit is sold, the importer must confirm four things: that the right conformity assessment was carried out, that the manufacturer drew up the technical documentation, that the product bears the CE marking with the EU declaration of conformity and the required user information, and that the manufacturer has set up the contact and support information the regulation requires. If any of these is missing, the product cannot be placed on the market.

Article 19 of the Cyber Resilience Act sets out those duties. The importer does not have to redo the manufacturer's security testing, but it has to be able to show, with documents, that it checked. In practice, an importer of servers or switches should hold on file the EU declaration of conformity naming Regulation (EU) 2024/2847, the conformity assessment route used (and the notified body certificate for Annex III products where required), and the information and instructions listed in Annex II: the manufacturer's contact point for vulnerability reports, the intended purpose, the end date of the support period, and how security updates are installed.

The support period deserves particular attention. Under Article 13 of the regulation, manufacturers must handle vulnerabilities effectively for a support period that reflects the expected time in use, and it must be at least five years unless the product is expected to be used for less. For hardware that typically runs seven or eight years in a data center, an importer that accepts a declared support period of three years is taking on a product that will raise questions.

Article 19 also requires the importer to put its own name, registered trade name or trademark, postal address, email or other digital contact and, where available, website on the product, its packaging or an accompanying document. For high-value equipment that ships in master cartons, many importers use an accompanying document or a label on the outer packaging. Whatever the method, it has to be in place before the goods are released for free circulation.

Some checks become a red flag on their own. If the importer has reason to believe the product does not meet the essential cybersecurity requirements in Annex I, or that the manufacturer's vulnerability handling processes are not in place, it must not place it on the market until that is fixed. If the product presents a significant cybersecurity risk, the importer must inform both the manufacturer and the national market surveillance authorities.

The table below summarises how the main duties split between the two parties for a typical server or switch.

Do the reporting obligations already apply to imported hardware?

Yes. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents affecting their products to the national CSIRT and ENISA, and this covers products already on the EU market. Importers are not the primary reporters, but they must pass on what they learn without undue delay.

The European Commission set out the timeline when reporting started: an early warning within 24 hours of the manufacturer becoming aware, a full notification within 72 hours, a final report within 14 days after a fix is available for an actively exploited vulnerability, and within one month for a severe incident. Reports go through the Single Reporting Platform run by ENISA, the EU Agency for Cybersecurity.

For an importer, this has two practical effects. First, it needs a working channel to the manufacturer's security team, not just to its sales or logistics contacts. If a customer reports that a switch firmware version is being exploited, the importer must be able to pass that on the same day. Second, when the importer itself finds out that a product it placed on the market has a vulnerability, Article 19 requires it to inform the manufacturer without undue delay, and to inform market surveillance authorities immediately if the product presents a significant cybersecurity risk.

The Commission keeps its guidance, timelines and implementing acts on its Cyber Resilience Act rules page, which is the reference to check before each new product line.

Does the Cyber Resilience Act apply to hardware already sold in the EU?

Only partly. Products placed on the market before 11 December 2027 fall under the new requirements only if they undergo a substantial modification after that date. The exception is reporting, which applies to all in-scope products, whenever they were placed on the market.

That transitional rule in Article 69 has a direct impact on import planning. A batch of servers released for free circulation in November 2027 does not need CRA conformity, but a batch released in January 2028 does, even if it is the same model from the same production run. For projects that span the deadline, such as a data center build that receives hardware in waves, the conformity status of each shipment depends on its own date of placing on the market.

A substantial modification can also pull older hardware into scope. A firmware change that adds new functions or alters the product's risk profile can count as one, while ordinary security patches usually do not. Refurbished servers and network equipment that are reworked and sold again need a case-by-case look, which is one more reason to keep firmware histories and support commitments in the import file.

What happens if imported hardware does not comply?

National market surveillance authorities can order corrective action, withdrawal or recall, and customs can suspend the release of goods at the border. Fines for breaching the importer obligations reach up to 10 million euros or 2 percent of worldwide annual turnover, whichever is higher.

Article 64 of the Cyber Resilience Act sets three tiers of administrative fines. Breaches of the essential requirements and the manufacturer obligations in Articles 13 and 14 can reach 15 million euros or 2.5 percent of worldwide turnover. Breaches of the importer and distributor obligations, along with several other duties, sit in the second tier at 10 million euros or 2 percent. Supplying incorrect or misleading information to notified bodies or authorities can reach 5 million euros or 1 percent.

The commercial cost usually arrives first. Under Regulation (EU) 2019/1020, customs authorities can suspend release when a product lacks the CE marking, the documents or the details of an EU-established responsible operator. For a shipment of AI servers or core routers worth several hundred thousand dollars, a suspended release means storage costs, project delays and a buyer asking why nobody checked earlier.

How should non-EU hardware vendors prepare their EU imports?

Start by deciding who will be the importer, then build a compliance file for each product family before the first shipment that will be placed on the market after 11 December 2027. Vendors that do this in 2026 and 2027 avoid the rush when notified bodies and standards are at full capacity.

The work is easier to manage when it follows the order in which documents are needed:

1. Classify each product family as default, Annex III Class I or Class II, or Annex IV, using the core functionality test and the technical descriptions in Implementing Regulation (EU) 2025/2392.
2. Confirm the conformity assessment route with the manufacturer and, for important products, the notified body and expected certificate date.
3. Collect the EU declaration of conformity, the Annex II user information, the support period end date and the vulnerability contact point, and check that the declaration cites Regulation (EU) 2024/2847.
4. Agree how the importer's name and contact details will appear on the product, packaging or accompanying document.
5. Set up the channel between the importer and the manufacturer's security team for vulnerability reports and corrective actions.
6. Keep the file for at least 10 years, or for the support period if longer.

This file overlaps with what EU buyers already ask for under other rules. The same importer usually handles the EORI number, import VAT and customs value, and is often the producer registered for WEEE in the country of sale. Our guide on how to import into the EU without an EU entity covers those customs and tax steps. For routers and switches, which carry both radio and cybersecurity obligations, the checks described in our article on importing networking equipment should be part of the same file.

Some vendors prefer to keep the importer role close to their own operation rather than handing it to each customer. A dedicated provider can take that role across several markets; for a closer look at what taking on the importer role in the EU involves for non-EU sellers, our partner team in the Comex network has a detailed overview.

Can an Importer of Record cover the Cyber Resilience Act role?

Yes, when the Importer of Record is established in the EU and accepts the importer duties under product law, not only the customs declaration. The agreement should say clearly who holds the declaration of conformity, who receives vulnerability reports and who decides on a recall.

An Importer of Record that only lodges the customs entry and pays duties covers part of the picture. For connected hardware after December 2027, the EU-established party that places the product on the market also has to perform the Article 19 checks and keep the records. That works well when the vendor gives the importer access to the technical documentation or to a manufacturer contact who can produce it on request, as the regulation allows the documentation itself to stay with the manufacturer.

The arrangement needs clear boundaries. The importer verifies, labels, records and reports. The manufacturer designs, assesses, patches and supports. When both sides know where the line sits, the CE marking on a server or switch becomes something the buyer can rely on, and the shipment clears without a debate at the border.

If you are planning shipments of servers, switches or security appliances into Europe and need an EU-established party to take the importer role, Comex IOR Services can help you organise the compliance file, the customs entry and the delivery as one process. Tell us about your hardware and timeline through our Importer of Record in the EU contact form, and our team will come back with a practical plan for your first CRA-ready import.