Multi-Role CRA: Manufacturer, Importer, Distributor

Your company manufactures smart sensors in Germany, imports complementary devices from a Taiwanese supplier, and distributes another vendor's software. Under the CRA, you are simultaneously a manufacturer, importer, and distributor. The single-role cluster guides cover each obligation set in isolation. This page is what multi-role compliance teams actually need: the operational layer where roles stack, conflict, and bleed into each other. For per-role obligations themselves, follow the links to the manufacturer cluster, importer cluster, and distributor cluster.

How multi-role companies fail differently

Single-role companies fail at the obligations of their one role. Multi-role companies fail at the seams between roles. Three failure modes recur.

Split-brain compliance. Each role's team operates against its own playbook without a shared product-to-role map. Sales sells the white-label product under your brand on Monday. The manufacturer team never gets the rebrand notice. The conformity assessment for the rebadged product never runs. Three months later a market-surveillance authority asks for the manufacturer evidence chain on a unit that was sold as your-branded but is documented as an imported third-party product. The legal position is indefensible.

Policy collision. Two roles' policies are applied to the same product because the role wasn't pinned. Your CVD policy says 90 days. Your supplier's policy says 120 days. Without a clear per-product role assignment, your engineering team uses the policy attached to the role they think you have, not the role the CRA assigns to that product.

Supplier audit redundancy. As an importer, you run pre-market verification on a supplier's product. As a manufacturer with the same supplier as a component vendor, you run component due diligence on the same supplier. Same supplier, two evidence files, two budgets, two interviews. The audit can be consolidated, but only if your role-per-product map is explicit enough to make the dual-purpose claim defensible.

The multi-role obligation stack

Some compliance infrastructure consolidates across roles. Some stays role-separate. The table below is the operational layer multi-role companies need before they invest in tools, processes, or org structure.

The infrastructure that consolidates is the multi-role efficiency win. The infrastructure that stays role-separate is where compliance teams trip up if they assume one policy can serve every product.

Organisational structure options

Three patterns work for a multi-role compliance org. Pick the one that matches your portfolio.

Option 1: Role-based teams. Separate teams for manufacturer, importer, and distributor activity. Best when each role has substantial volume.

Compliance Department
├─ Manufacturing Compliance Team   → all manufacturer obligations
├─ Import Compliance Team          → supplier verification, import docs
└─ Distribution Compliance Team    → partner relationships, distribution records

Option 2: Product-based teams. One team per product line, owning every role for the products in that line. Best when product lines are narrow and roles per line are mixed.

Compliance Department
├─ Product Line A Team (sensors)        → all roles for sensor products
├─ Product Line B Team (controllers)    → all roles for controller products
└─ Shared Services                      → document management, SBOM tools, training

Option 3: Hybrid (recommended for most). Shared core services plus role-specialised teams. Single document store and vulnerability intake, but separate manufacturer and supplier/partner teams.

Compliance Department
├─ Core Compliance              → document mgmt, vulnerability intake, training
├─ Manufacturer Compliance      → conformity assessment, technical files, updates
└─ Supplier/Partner Compliance  → import verification, distributor relationships

Cost allocation example

A practical budget split for a multi-role company with 5 manufactured products, 10 imported, and 15 distributed.

MULTI-ROLE COMPLIANCE BUDGET (annual)

SHARED INFRASTRUCTURE (40% of budget):
  Compliance management system:    $25,000
  Document management:             $10,000
  Training program:                $15,000
  Vulnerability intake:            $10,000
  SUBTOTAL                         $60,000

MANUFACTURER ROLE (35% of budget):
  Conformity assessment (5 products): $25,000
  SBOM tooling:                        $8,000
  Update infrastructure:              $15,000
  Technical file maintenance:          $5,000
  SUBTOTAL                            $53,000

IMPORTER ROLE (20% of budget):
  Supplier verification (10 products): $20,000
  Documentation requests:               $5,000
  Supplier monitoring:                  $5,000
  SUBTOTAL                             $30,000

DISTRIBUTOR ROLE (5% of budget):
  Partner verification:                 $5,000
  Record keeping:                       $2,500
  SUBTOTAL                              $7,500

TOTAL                                 $150,500

The 40% shared-core slice is the multi-role efficiency win. The 35% manufacturer slice expands sharply if any imported product crosses into manufacturer status because you start branding it or substantially modifying it.

Conflicting-timeline scenarios

Multi-role companies hit timeline conflicts that single-role companies never see.

Conflicting CVD windows. Your manufactured products run a 90-day coordinated-vulnerability-disclosure window. Your supplier (whose products you import) insists on 120 days. Resolution: separate policies by role. Your CVD policy applies only to products you manufacture. For imported products, the manufacturer's policy is the one that matters. Your role is to verify it exists, is reachable, and is consistent with the CRA minimum.

Documentation-standard mismatch. Your manufacturer technical file template follows your internal documentation standard. Your supplier's documentation is structured to its own domestic regime. Resolution: keep separate templates per role. Do not force supplier documentation into your manufacturer template, or you will lose verifiability when a market-surveillance authority asks for the original source.

Supplier non-cooperation. You are an importer, but your supplier will not provide the documentation you need for pre-market verification. Resolution: the deal is broken. Without the documentation, you cannot legally place the product on the EU market. Hold the shipment, formalise the documentation request in writing, and if the supplier still refuses, change supplier.

Support-period cascade. As manufacturer, you commit a 7-year support period for your own product. The same product line includes a rebadged OEM component you also imported (so you are both manufacturer of one variant and importer of another). The OEM commits only 5 years for the imported variant. Your customers may see both variants on your shelf. Resolution: communicate the per-variant support period clearly at point of sale. Do not let your marketing claim one envelope across both variants.

ENISA SRP access boundary. The ENISA Single Reporting Platform is the manufacturer-side reporting channel. Multi-role companies set up SRP access for their manufacturer role. For products you only import or distribute, the original manufacturer is the one reporting through SRP. Your role is to inform that manufacturer and (where significant cybersecurity risk exists) inform market surveillance directly, not to report to ENISA on the original manufacturer's behalf.

Vulnerability notification fan-out

One vulnerability is reported. It affects three product cohorts in your portfolio: products you manufacture, products you imported, and products you distribute. What fires where, in what order, and who signs.

For a single-incident, multi-cohort event, the notifications run in parallel, not in sequence. The manufacturer-stream notification has a regulatory clock. The importer and distributor notifications run on the without-undue-delay standard. Do not let the manufacturer-side clock dominate the importer/distributor escalation, because the importer and distributor duties exist independently.

For per-cohort cadence, escalation thresholds, and the role-specific reporting flows, the manufacturer reporting flow, the importer cease-operations cascade, and the distributor vulnerability awareness sections in the cluster set are the canonical references.

Authority-request triage across roles

A market-surveillance authority issues a reasoned request. Different roles produce different evidence packs in response.

Build the role-evidence map per product before a market-surveillance authority asks for it. The day a reasoned request arrives, the question is not "where is the evidence". The question is "which evidence pack matches the role this product carries on this date." A multi-role team that has not pre-built the map will burn a working day reconstructing the wrong evidence chain.

Penalty exposure when you're multi-role

A single vulnerability incident can trigger more than one penalty tier when the vulnerable code is in products across multiple roles.

The tiers apply per breach, not per product. A multi-role company that runs the same vulnerable component across manufactured and imported product lines, and fails to notify, is exposed to the manufacturer tier for the manufactured cohort and the importer tier for the imported cohort, in parallel. Insurance underwriting and board-level risk modelling should account for both ceilings, not just the higher one.

The mitigation is operational, not contractual. The role-evidence map plus the per-role notification fan-out gives you a defensible record of which products were notified when, under which role's protocol. Without that record, an authority can press the company to prove which role applied to each product before the penalty tier is assessed.

Cross-Member-State multi-role topology

When a multi-role org operates across Member State borders, the role-per-product map gets a second axis: which national authority contacts to pre-stage per role, and what language each Member State of supply expects on user information.

Take an EU group that manufactures sensors in Germany, imports controllers from a Taiwanese supplier through its French entity, and distributes a Belgian vendor's software through its Italian sales arm.

A vulnerability that hits all three cohorts triggers parallel notifications to three different national MSAs at the same time, each in the appropriate national language. The CRA does not have a single-pane-of-glass route across Member States for a multi-role org. Build the per-cohort MSA-contact rolodex now. The first time you reach for it should not be in an incident.

When the same legal entity is AR, importer, and manufacturer

The authorised-representative arrangement is permissive, not mandatory. A non-EU manufacturer may appoint an EU-established entity as its authorised representative under a written mandate. Nothing in the CRA prevents that same EU entity from also being the importer for a different non-EU vendor's products, or the manufacturer of its own product line.

This is the most concentrated multi-role overlap in the CRA. Three things must stay separated even though they sit under one corporate roof:

Mandates are per-vendor. Each authorised-representative relationship is documented by a written mandate. If you act as AR for non-EU vendor A and importer for non-EU vendor B, the AR record covers vendor A only. Vendor B's products run on the importer regime, with no mandate overlay.

Liability bounds differ per role. The AR holds documentation and cooperates with market surveillance on behalf of the represented manufacturer, but does not place products on the market. The importer carries the four-check pre-market verification, places the product on the market, and retains the EU Declaration of Conformity for 10 years or the support period. The manufacturer carries the full design and engineering obligation set. These are three different liability surfaces, all sitting under one legal person. Records must support the role split per product.

Cessation routing is per role. If vendor A, for whom you are AR, ceases operations, check the written mandate and preserve the AR documentation and cooperation file. The statutory cessation notice itself sits with the manufacturer unless another role-specific trigger also applies. If vendor B (for whom you are importer) ceases operations, the importer's awareness-of-cessation notice fires: inform market surveillance and users about the manufacturer's cessation. Your own manufacturer line, if it ever ceases, fires the manufacturer self-cessation notice with your own customer-communications path. The three triggers do not consolidate into one routing.

The practical floor: a per-product map with the role tag attached to every product makes the AR/importer/manufacturer separation defensible. Without that map, an audit on vendor A's products will spill into your importer and manufacturer records and create avoidable evidence-discovery costs.

When roles shift mid-lifecycle

Multi-role companies see product roles shift over a product's lifecycle. Five events recur.

Distributor to importer. Your EU supplier closes, and you start importing directly from the non-EU manufacturer. Actions: full importer verification on the product, direct supplier relationship, refresh of all import documentation.

Importer to manufacturer. You start placing the imported product under your own brand. Actions: complete the manufacturer obligation set (conformity assessment, technical file, SBOM, vulnerability handling, support-period commitment). Your supplier is now a contract manufacturer in commercial terms, not the CRA manufacturer. The compliance ownership moves to you.

Distributor to bundle-modifier. You start pre-installing custom firmware on a product you previously distributed unchanged. Actions: manufacturer obligations apply via the rebrand bridge for the modified product or, where the modification affects cybersecurity of the whole product, for the entire product.

Manufacturer to distributor. You stop branding a product line and pass it back to the OEM under the OEM's own brand. Actions: the original manufacturer regains the manufacturer role from that point. You become the distributor of the OEM-branded product. Your manufacturer-side retention and support obligations continue for units already placed under your brand.

Any role to exit. You stop selling a product. Actions: document retention continues (manufacturer and importer carry 10-year or support-period retention). Manufacturer support obligations continue for at least 5 years from the last unit placed on the market, or the support period if committed longer. If the manufacturer is also ceasing operations, the notice duty routes through any importer and distributor in the chain.

Business continuity when the multi-role org folds

The CRA has one statutory self-cessation notice: the manufacturer's. When a manufacturer ceases operations and can no longer comply, it must inform the relevant market surveillance authorities and the users of products already placed on the market, before the cessation takes effect. There is no equivalent self-cessation notice for the importer or distributor roles. The importer and distributor cessation duties in the CRA only fire when the manufacturer of a product they handle ceases operations, not when the importer or distributor itself ceases.

For a multi-role organisation that folds, this means:

Treat the manufacturer self-cessation notice as the regulated event. Treat the importer, distributor, and AR transitions as operational record-continuity planning, not as additional statutory notice streams. Multi-role companies that conflate the four (and assume the importer and distributor have their own self-cessation notice obligation) over-build the runbook and may delay the one statutory notice that actually matters.

This article is for informational purposes only and does not constitute legal advice. For specific compliance guidance, consult with qualified legal counsel.