A desk with documents, representing supplier and component records under the CRA

CRA Supply Chain and Third-Party Components

You put your brand on it, but you did not build all of it. The CRA still makes you answerable for the whole product. These guides show what you have to produce yourself, what you only need to check from a supplier, and when buying from someone else quietly turns you into the manufacturer.

Build your supply-chain expertise

Three guides covering whether to integrate a component or import a finished product, how to vet the suppliers behind your parts, and where an OEM or white-label deal makes you the manufacturer.

Integrating vs importing third-party components

How you buy decides who owns the paperwork. Drop a module, chip or SDK into your own product and the final file is yours to write. Import something already finished and you just check the maker's. Decide which one it is before you raise the purchase order.

Read guide →
Supplier due diligence: questionnaire and red flags

Checking your suppliers is your job, and it reaches the free open-source you pull in, not just the vendors you pay. A questionnaire you can send as-is, playbooks for FOSS, cloud, hardware-only ODMs and open-source stewards, the red flags to catch early, and the contract clauses that make it stick.

Read guide →
White-label and OEM: who is the manufacturer?

Put your brand on a product someone else built and you are the manufacturer from the first sale. Where the OEM, private-label and modification lines fall, when the support clock starts, whose SBOM it is, and the clauses that keep your OEM on the hook.

Read guide →
← Back to CRA compliance hub