Maintain supply chain traceability records and provide them on request

Every business in the CRA supply chain — manufacturer, importer, distributor, and OSS steward — must keep records that allow them to trace one step up and one step down: who sold to you, and who you sold to. You don't have to map the entire supply chain, just your immediate neighbours. You must be able to provide this information to market surveillance authorities on request, and you must keep the records for 10 years from each supply transaction.

Legal text

Article 23(1) of Regulation (EU) 2024/2847 requires that economic operators, on request, provide market surveillance authorities with:

(a) the name and address of any economic operator who has supplied them with a product with digital elements;

(b) where available, the name and address of any economic operator to whom they have supplied a product with digital elements.

Article 23(2) sets the retention period:

Economic operators shall be able to present the information referred to in paragraph 1 for 10 years after they have been supplied with the product with digital elements and for 10 years after they have supplied the product with digital elements.

Scope

This obligation applies to all economic operators defined in Art. 3(12): manufacturers, authorised representatives, importers, distributors, and any other natural or legal person subject to obligations relating to PDEs under the CRA.

For OSS stewards subject to market surveillance under Art. 24, this obligation also applies in the context of their supply relationships.

Key points

One step up, one step down — you are only required to identify your direct supplier and direct customer, not the entire upstream/downstream chain
"Where available" for outbound — the obligation to name who you supplied the product to is qualified by "where available", reflecting that some distributions (e.g. retail) may not capture individual customer details
10-year periods run separately — the clock starts from when you received the supply AND from when you made the supply; both periods must be covered
On request only — this is not a proactive disclosure obligation; information is provided when market surveillance authorities ask for it

Practical implementation

Consider maintaining:

Purchase order / invoice records identifying the supplying entity and product
Sales records identifying the receiving entity and product
A retention policy ensuring records are available for at least 10 years

Relationship to penalties

Non-compliance with Art. 23 obligations is subject to fines of up to €10 000 000 or 2% of annual worldwide turnover under Art. 64(3).