Do not make non-conforming products available on the market
- Applies to
- Distributor
- Source citations
- Art. 20(2)
- Product classes
- DefaultImportant — Class IImportant — Class IICritical
If anything makes you think a product does not meet the CRA's requirements — your own checks, a customer complaint, or information from the supply chain — you must stop selling it until the issue is resolved. You must also tell the manufacturer what you found, and if the problem creates a significant cybersecurity risk, you must notify the national regulator too.
Legal text
Article 20(2) of Regulation (EU) 2024/2847 provides that where a distributor considers or has reason to believe that a product with digital elements is not in conformity with the essential requirements set out in Annex I or with any other applicable requirement of this Regulation, the distributor shall not make the product available on the market until the product has been brought into conformity with those requirements.
Where the product poses a significant cybersecurity risk, the distributor shall inform the manufacturer and, if there is an importer in the supply chain, the importer, as well as the relevant market surveillance authorities.
Key requirements
- Low threshold — "reason to believe" does not require certainty; a credible concern is sufficient
- Hold from market — do not list, sell or distribute the product until conformity is confirmed
- Notify manufacturer — inform the manufacturer of the identified concern
- Notify importer — also inform the importer where one is in the supply chain
- Escalate significant risks — notify national market surveillance authority if the product poses a significant cybersecurity risk
Evidence you may need
- Non-conformity identification and escalation procedure
- Correspondence with manufacturer/importer regarding identified concerns
- Market withdrawal or hold decision records
- Notifications to market surveillance authorities where applicable