CRA Distributor Checklist: 5 Verification Steps for Every Product

This page is the shop-floor companion to the CRA distributor cluster guide. The cluster guide is the regulatory framework: who counts as a distributor, what the duty set is, how authority requests work. This blog is what the receiving desk, warehouse team, and sales reps actually use: a quick-reference card, a printable intake checklist, the supply-chain scenarios that distributors hit in real operations, and the concrete acts that move you from distributor into manufacturer status without you noticing.

At-a-glance receiving check

Print and keep at the receiving desk for fast-pass acceptance decisions.

+-------------------------------------------------+
|         DISTRIBUTOR CRA QUICK CHECK             |
|                                                 |
|  ✓ CE marking visible and correct?              |
|  ✓ Manufacturer name/address on product?        |
|  ✓ Instructions in correct language?            |
|  ✓ No obvious defects or tampering?             |
|  ✓ No recall notices for this product?          |
|                                                 |
|  ALL YES → OK to sell                           |
|  ANY NO  → STOP, document, notify supplier      |
|  NEVER:  Modify firmware, rebrand, or ignore    |
+-------------------------------------------------+

The full intake checklist

Use this when receiving products from suppliers. Print, fill in per shipment, file with the receiving log.

DISTRIBUTOR RECEIVING CHECKLIST

Product: _______________________________________
Supplier: ______________________________________
Date Received: _________________________________
Batch / Lot: ___________________________________
SKU: ___________________________________________
Quantity: ______________________________________

VISUAL VERIFICATION:
[ ] CE marking present on product or packaging
[ ] CE marking correctly formatted (proportions, size)
[ ] Manufacturer name and address visible
[ ] Importer name and address visible (if non-EU origin)
[ ] Product packaging intact (no tampering evidence)

DOCUMENTATION CHECK:
[ ] User instructions present
[ ] Instructions in required language(s)
[ ] Safety information included
[ ] DoC reference or document present
[ ] DoC URL resolves to a full EU Declaration of Conformity
[ ] Support-period end date visible (month and year)

COMPLIANCE STATUS CHECK:
[ ] No active recall notices for this product
[ ] No communications from manufacturer about issues
[ ] No regulatory warnings about this product
[ ] Supplier has not flagged any concerns

STORAGE REQUIREMENTS:
[ ] Storage conditions appropriate for product type
[ ] Tamper-evident seals intact
[ ] No modifications required before sale

DECISION:
[ ] ACCEPT - All checks passed
[ ] HOLD - Issues identified (specify below)
[ ] REJECT - Non-compliant (document and notify supplier)

Issues Identified:
________________________________________________
________________________________________________

Verified by: ___________________________________
Date: _________________________________________

Keeping the product unchanged in storage and transport

The intake check is only half the job. Distributors must keep the product in the same compliance state from receipt to delivery. Any act that changes the product after the manufacturer placed it on the market can flip the distributor role into manufacturer status.

Storage:

• Products are not modified during storage. No firmware updates pushed by the distributor's IT team. No "preventive" configuration tweaks.
• Environmental conditions do not compromise security features. Tamper-evident seals stay intact.
• Battery replacement during long storage is risky. Identical-part replacement may stay in the spare-parts carve-out, but a different battery chemistry or firmware change pushes the product into modified territory.

Transport:

• Products arrive to customers in the same compliance state as received. The shipping label is the distributor's, the product inside is not.
• Packaging integrity is maintained. A damaged outer carton that exposes the product mid-route gets quarantined for re-verification, not silently repackaged.
• Cross-border transport between EU Member States does not change the compliance state. The product is already placed on the Union market, and you are making it available in a second Member State.

Practical example. If you store IoT devices in a warehouse, you cannot "helpfully" update their firmware before shipping. A firmware change by the distributor is a substantial modification and triggers the manufacturer-obligation switch via the rebrand bridge. Let customers update their own devices, or route updates through the original manufacturer.

Distributor scenarios you actually face

The cluster guide covers the framework. These are the supply-chain situations distributors hit in real operations and the answers are not always obvious from reading the framework.

Drop-shipping where you never touch the stock

You take orders, the non-EU manufacturer or another EU entity ships direct to the end customer. Are you the distributor?

The legal trigger is "making available on the Union market", not physical possession. If you take title to the goods, invoice the customer, and the legal supply relationship runs through your business, you are the distributor regardless of who handles the box. The presence-based intake check still applies to you. You need a documented agreement with the upstream supplier that the CE, DoC, user information, and importer identification will be in place before the shipment leaves their warehouse.

If the relationship is pure introduction (you match buyer and seller, you never take title, the supply contract is between buyer and the upstream entity directly, you do not invoice the goods), you are generally outside the distributor regime. The boundary is fact-specific. Read the contract structure, not the ownership of the warehouse.

Marketplace operator and Amazon-FBA-style fulfilment

Two different boundary tests:

You operate the marketplace. If your platform only matches buyers and third-party sellers and never takes title, you are generally not a distributor under the CRA, in line with the broader EU framework on online intermediaries. If your platform takes title (you buy stock from suppliers, list it, fulfil orders against your own inventory), you are a distributor.

You sell on someone else's marketplace. If you are a third-party seller using Amazon FBA, Cdiscount fulfilment, or an equivalent service, you are the distributor. The fulfilment provider is a logistics service, not the distributor. Your intake check, your refusal duty, your vulnerability flow.

B2B-only distribution

The CRA applies to "products with digital elements placed on the Union market" without distinguishing B2B from B2C in scope. Distributor obligations are the same: intake check, refusal duty, vulnerability flow, cooperation with market surveillance.

Two practical differences for B2B:

• User-information language. The end customer is a downstream business that may operate in English or another commercial language. The legal floor is the language easily understood by users and market surveillance of the Member State of supply. For internal corporate end-users at a multinational, English may be commercially negotiated. For commercial end-users that re-deploy the product to consumer-facing settings, the local-language requirement is back.
• Vulnerability awareness. A B2B distributor typically learns about vulnerabilities through commercial channels (helpdesk tickets, supplier bulletins) rather than consumer reports. The "without undue delay" notification clock still starts when you become aware.

Refurbished or used CRA products

The CRA covers products placed on the Union market. A refurbished product re-placed on the market by a new entity may or may not be a fresh product placement, depending on what was changed.

The boundary depends on whether the refurbishment substantially modifies the product. Cleaning, re-packaging, and replacing identical components within the spare-parts carve-out keep the product in distributor territory. Replacing a battery with a different chemistry, re-flashing firmware, or restoring a non-original software image is substantial modification and pushes the refurbisher into manufacturer status for the modified product.

Practical rule: if you are reselling a unit you bought from a known manufacturer in its original state, you are a distributor. If you are restoring units after a hardware swap or firmware overhaul, get the legal interpretation before treating it as distribution.

Bundle sellers

You combine 2-3 products into a single SKU.

Bundling without modification. Each product inside the bundle keeps its own manufacturer, its own CE, its own DoC. You are the distributor of each product. The bundle's outer packaging needs to make the constituent products and their compliance documents identifiable. Your intake checklist runs per product, not per bundle.

Bundling with custom firmware or configuration. If you push a custom firmware image, change security defaults, or pre-configure products to work together in a way that changes their intended purpose, that is substantial modification. You become the manufacturer for the bundle, and the manufacturer obligations apply to the affected part of the product or, where the change affects cybersecurity of the product as a whole, to the entire product.

Bundle branding. Putting a "Distributed by ACME" sticker on the bundle does not by itself trigger the rebrand bridge. Replacing the individual manufacturers' brand identifiers with yours does. The cluster pitfall on stripping the importer's contact label applies here too.

Cross-border supply when a vulnerability arises

You distributed a product into six Member States. A vulnerability is reported and presents significant cybersecurity risk. Who do you notify?

Notify market surveillance in every Member State of supply, in parallel, without undue delay. You also inform the manufacturer of the vulnerability without undue delay. The manufacturer separately runs the ENISA reporting stream, which is not the distributor's job.

Practical preparation: keep a per-product, per-supply Member State distribution log. Build a one-click MSA-contact rolodex. When a vulnerability is reported on a product in your catalogue, you should not be looking up the BSI vulnerability-reporting address for the first time at 23:00.

What tips you into manufacturer status

Distributor status is fragile. Several small operational acts can move you across the line into manufacturer obligations without you noticing. This is the act-by-act matrix.

For the regulatory framework behind these calls, the cluster guide's Am I a distributor or a manufacturer? FAQ has the verbatim Article 21 text and the Article 22 third-party-modifier distinction.

When customs holds your shipment

A non-EU shipment can be held at customs if national customs authorities flag a CE, conformity, or product-information defect. The CRA does not regulate customs directly, but it routes through the existing EU market-surveillance framework that applies at the border.

What customs typically demands:

• A copy of the EU Declaration of Conformity, full or simplified with a working URL to the full version.
• Evidence of the conformity assessment route used (Module A self-assessment, or notified-body certificate number for Important Class II or Critical products).
• The manufacturer and importer identification, postal addresses, and digital contacts.
• User information and instructions in a Member State language.
• The CE marking placement evidence on a sample unit.

What the distributor can do at the hold:

• Provide the documents you would have collected at the intake check. If your supplier did not give them to you, you should not have accepted the shipment in the first place.
• Coordinate with the importer, who carries the heavier verification duty and the 10-year retention obligation. If the importer has the technical documentation table of contents, customs will usually accept that as evidence the file exists.
• Hold the goods in customs warehousing while gaps are closed. Customs warehousing is a legitimate intermediate state. Customer-facing supply is not.
• Return the shipment to the supplier or destroy if the gap cannot be closed in a reasonable window. Member State customs rules vary on the destruction window.

Common Pitfalls

The cluster guide has the full eight-pitfall table for distributor-vs-importer mistakes, presence-based-verification mistakes, and vulnerability-flow mistakes. This blog adds three pitfalls specific to the operational layer.