Do not place non-conforming products on the market
- Applies to
- Importer
- Source citations
- Art. 19(2)
- Product classes
- DefaultImportant — Class IImportant — Class IICritical
If you have any reason to think a product does not meet the CRA's cybersecurity requirements, you must hold it back from the EU market until the issue is fixed. "Any reason to believe" is a low threshold — it includes concerns from your own checks, customer complaints, or information from the manufacturer.
Legal text
Article 19(2) of Regulation (EU) 2024/2847 provides that where an importer considers or has reason to believe that a product with digital elements is not in conformity with the essential requirements set out in Annex I or with any other applicable requirement of this Regulation, the importer shall not place the product on the market until the product has been brought into conformity with those requirements.
Where the product poses a significant cybersecurity risk, the importer shall also inform the manufacturer and the relevant market surveillance authority.
Key requirements
- Threshold is low — "reason to believe" does not require certainty; doubt is sufficient to trigger the obligation to hold
- Hold until conformity — the product must not be placed on the market until the non-conformity is remedied
- Notify manufacturer — inform the manufacturer of the identified non-conformity
- Escalate significant risks — notify the national market surveillance authority if the product poses a significant cybersecurity risk
Evidence you may need
- Non-conformity assessment records
- Correspondence with the manufacturer regarding the identified issue
- Corrective action log and outcome documentation
- Notifications sent to market surveillance authorities (if applicable)