CRA RACI Responsibility Matrix
This matrix maps every key CRA obligation to the relevant supply chain roles, based on the Cyber Resilience Act (EU) 2024/2847. Use it to understand your organisation's duties and how they relate to other parties.
RACI Legend
R Responsible — Executes the work
A Accountable — Ultimately answerable
R/A Both — Executes and answerable
C Consulted — Provides input
I Informed — Kept up to date
— N/A — Not applicable
Where a row shows R/A for more than one role, each party bears the obligation independently for their own scope. Hover over any cell for detailed legal context.
| CRA Obligation / Activity | Mfr Art. 13 | Auth Rep Art. 15 | Imp Art. 19 | Dist Art. 20 | NB Art. 35–49 | OSS Steward Art. 24 | OSS Vol Recital 18 |
|---|---|---|---|---|---|---|---|
| Secure-by-design product development | R/A a R/A Manufacturer Responsible & Accountable Art. 13: Manufacturer bears primary legal obligation for product design, development, production, and lifecycle security. | I d I Authorised Representative Informed Art. 15: Auth Rep has a limited mandate; informed of the manufacturer's activities but not directly involved in execution. | I h I Importer Informed Art. 19: Importer informed of outcomes; no active execution or verification duty for this specific activity. | I j I Distributor Informed Art. 20: Distributor informed; lighter due-care obligations do not require active involvement in this activity. | — | C o C Open-Source Software Steward Consulted Art. 24: Steward consulted as ecosystem participant or source of open-source components integrated by manufacturers. | — |
| Cybersecurity risk assessment (pre-market) | R/A a R/A Manufacturer Responsible & Accountable Art. 13: Manufacturer bears primary legal obligation for product design, development, production, and lifecycle security. | I d I Authorised Representative Informed Art. 15: Auth Rep has a limited mandate; informed of the manufacturer's activities but not directly involved in execution. | C g C Importer Consulted Art. 19: Importer consulted as a supply chain stakeholder during the manufacturer's pre-market activities. | I j I Distributor Informed Art. 20: Distributor informed; lighter due-care obligations do not require active involvement in this activity. | C l C Notified Body Consulted NB reviews relevant documentation (risk assessments, SBOMs, technical files) as input to its assessment activities. | C o C Open-Source Software Steward Consulted Art. 24: Steward consulted as ecosystem participant or source of open-source components integrated by manufacturers. | — |
| Ongoing risk assessment updates (5 yr / life) | R/A a R/A Manufacturer Responsible & Accountable Art. 13: Manufacturer bears primary legal obligation for product design, development, production, and lifecycle security. | I d I Authorised Representative Informed Art. 15: Auth Rep has a limited mandate; informed of the manufacturer's activities but not directly involved in execution. | I h I Importer Informed Art. 19: Importer informed of outcomes; no active execution or verification duty for this specific activity. | I j I Distributor Informed Art. 20: Distributor informed; lighter due-care obligations do not require active involvement in this activity. | I m I Notified Body Informed NB informed of ongoing changes that may affect the validity of issued certificates. | I p I Open-Source Software Steward Informed Art. 24: Steward informed of activities relevant to stewarded components; no active execution duty. | — |
| Software Bill of Materials (SBOM) | R/A a R/A Manufacturer Responsible & Accountable Art. 13: Manufacturer bears primary legal obligation for product design, development, production, and lifecycle security. | I d I Authorised Representative Informed Art. 15: Auth Rep has a limited mandate; informed of the manufacturer's activities but not directly involved in execution. | I h I Importer Informed Art. 19: Importer informed of outcomes; no active execution or verification duty for this specific activity. | I j I Distributor Informed Art. 20: Distributor informed; lighter due-care obligations do not require active involvement in this activity. | C l C Notified Body Consulted NB reviews relevant documentation (risk assessments, SBOMs, technical files) as input to its assessment activities. | C o C Open-Source Software Steward Consulted Art. 24: Steward consulted as ecosystem participant or source of open-source components integrated by manufacturers. | — |
| Self-assessment (default products) | R/A a R/A Manufacturer Responsible & Accountable Art. 13: Manufacturer bears primary legal obligation for product design, development, production, and lifecycle security. | C e C Authorised Representative Consulted Art. 15: Auth Rep consulted on market access documentation; does not create or execute the underlying obligation. | C g C Importer Consulted Art. 19: Importer consulted as a supply chain stakeholder during the manufacturer's pre-market activities. | I j I Distributor Informed Art. 20: Distributor informed; lighter due-care obligations do not require active involvement in this activity. | — | — | — |
| Third-party assessment (Important Class I) † | R b R Manufacturer Responsible Art. 13/32: Manufacturer executes the obligation; Notified Body holds accountability for evaluating and certifying the assessment outcome. | C e C Authorised Representative Consulted Art. 15: Auth Rep consulted on market access documentation; does not create or execute the underlying obligation. | C g C Importer Consulted Art. 19: Importer consulted as a supply chain stakeholder during the manufacturer's pre-market activities. | I j I Distributor Informed Art. 20: Distributor informed; lighter due-care obligations do not require active involvement in this activity. | R/A k R/A Notified Body Responsible & Accountable Art. 47: Notified Body executes and is accountable for the conformity assessment procedure and/or its ongoing monitoring. | — | — |
| Third-party assessment (Important Class II) | R b R Manufacturer Responsible Art. 13/32: Manufacturer executes the obligation; Notified Body holds accountability for evaluating and certifying the assessment outcome. | C e C Authorised Representative Consulted Art. 15: Auth Rep consulted on market access documentation; does not create or execute the underlying obligation. | C g C Importer Consulted Art. 19: Importer consulted as a supply chain stakeholder during the manufacturer's pre-market activities. | I j I Distributor Informed Art. 20: Distributor informed; lighter due-care obligations do not require active involvement in this activity. | R/A k R/A Notified Body Responsible & Accountable Art. 47: Notified Body executes and is accountable for the conformity assessment procedure and/or its ongoing monitoring. | — | — |
| EU Certification or NB assessment (Critical/Annex IV) ‡ | R b R Manufacturer Responsible Art. 13/32: Manufacturer executes the obligation; Notified Body holds accountability for evaluating and certifying the assessment outcome. | C e C Authorised Representative Consulted Art. 15: Auth Rep consulted on market access documentation; does not create or execute the underlying obligation. | C g C Importer Consulted Art. 19: Importer consulted as a supply chain stakeholder during the manufacturer's pre-market activities. | I j I Distributor Informed Art. 20: Distributor informed; lighter due-care obligations do not require active involvement in this activity. | R/A k R/A Notified Body Responsible & Accountable Art. 47: Notified Body executes and is accountable for the conformity assessment procedure and/or its ongoing monitoring. | — | — |
| Technical documentation (10-year retention) | R/A a R/A Manufacturer Responsible & Accountable Art. 13: Manufacturer bears primary legal obligation for product design, development, production, and lifecycle security. | R c R Authorised Representative Responsible Art. 15(2): Auth Rep is mandated to keep technical documentation and EU DoC at the disposal of market surveillance authorities on the manufacturer's behalf. | I h I Importer Informed Art. 19: Importer informed of outcomes; no active execution or verification duty for this specific activity. | I j I Distributor Informed Art. 20: Distributor informed; lighter due-care obligations do not require active involvement in this activity. | C l C Notified Body Consulted NB reviews relevant documentation (risk assessments, SBOMs, technical files) as input to its assessment activities. | — | — |
| CE marking affixation | R/A a R/A Manufacturer Responsible & Accountable Art. 13: Manufacturer bears primary legal obligation for product design, development, production, and lifecycle security. | C e C Authorised Representative Consulted Art. 15: Auth Rep consulted on market access documentation; does not create or execute the underlying obligation. | C g C Importer Consulted Art. 19: Importer consulted as a supply chain stakeholder during the manufacturer's pre-market activities. | C i C Distributor Consulted Art. 20: Distributor exercises due care by verifying specific product markings, labelling, and user documentation. | — | — | — |
| EU Declaration of Conformity | R/A a R/A Manufacturer Responsible & Accountable Art. 13: Manufacturer bears primary legal obligation for product design, development, production, and lifecycle security. | C y C Authorised Representative Consulted Art. 15(1): Auth Rep consulted on EU DoC but does not draw it up; role limited to retention and making available to authorities. | C g C Importer Consulted Art. 19: Importer consulted as a supply chain stakeholder during the manufacturer's pre-market activities. | I j I Distributor Informed Art. 20: Distributor informed; lighter due-care obligations do not require active involvement in this activity. | — | — | — |
| Post-certification conformity monitoring | C v C Manufacturer Consulted Manufacturer provides information, technical cooperation, or access to documentation when requested by other parties or authorities. | I d I Authorised Representative Informed Art. 15: Auth Rep has a limited mandate; informed of the manufacturer's activities but not directly involved in execution. | I h I Importer Informed Art. 19: Importer informed of outcomes; no active execution or verification duty for this specific activity. | I j I Distributor Informed Art. 20: Distributor informed; lighter due-care obligations do not require active involvement in this activity. | R/A k R/A Notified Body Responsible & Accountable Art. 47: Notified Body executes and is accountable for the conformity assessment procedure and/or its ongoing monitoring. | — | — |
| Certificate suspension / withdrawal | I x I Manufacturer Informed Manufacturer/operators informed of NB actions (suspension, withdrawal) affecting their product's certification status. | I d I Authorised Representative Informed Art. 15: Auth Rep has a limited mandate; informed of the manufacturer's activities but not directly involved in execution. | I h I Importer Informed Art. 19: Importer informed of outcomes; no active execution or verification duty for this specific activity. | I j I Distributor Informed Art. 20: Distributor informed; lighter due-care obligations do not require active involvement in this activity. | R/A k R/A Notified Body Responsible & Accountable Art. 47: Notified Body executes and is accountable for the conformity assessment procedure and/or its ongoing monitoring. | — | — |
| Report certificate actions to notifying authority | I x I Manufacturer Informed Manufacturer/operators informed of NB actions (suspension, withdrawal) affecting their product's certification status. | I d I Authorised Representative Informed Art. 15: Auth Rep has a limited mandate; informed of the manufacturer's activities but not directly involved in execution. | I h I Importer Informed Art. 19: Importer informed of outcomes; no active execution or verification duty for this specific activity. | I j I Distributor Informed Art. 20: Distributor informed; lighter due-care obligations do not require active involvement in this activity. | R/A k R/A Notified Body Responsible & Accountable Art. 47: Notified Body executes and is accountable for the conformity assessment procedure and/or its ongoing monitoring. | — | — |
| Verify manufacturer conformity assessment | C v C Manufacturer Consulted Manufacturer provides information, technical cooperation, or access to documentation when requested by other parties or authorities. | C e C Authorised Representative Consulted Art. 15: Auth Rep consulted on market access documentation; does not create or execute the underlying obligation. | R/A f R/A Importer Responsible & Accountable Art. 19: Importer bears independent due-diligence gateway duty. This is verification of the existence and completeness of compliance, not a technical re-evaluation of quality. | I j I Distributor Informed Art. 20: Distributor informed; lighter due-care obligations do not require active involvement in this activity. | — | — | — |
| Verify CE marking present on product | — | — | R/A f R/A Importer Responsible & Accountable Art. 19: Importer bears independent due-diligence gateway duty. This is verification of the existence and completeness of compliance, not a technical re-evaluation of quality. | R i R Distributor Responsible Art. 20: Distributor exercises due care by verifying specific product markings, labelling, and user documentation. | — | — | — |
| Verify user instructions in required language(s) | R a R Manufacturer Responsible Art. 13: Manufacturer bears primary legal obligation for product design, development, production, and lifecycle security. | C e C Authorised Representative Consulted Art. 15: Auth Rep consulted on market access documentation; does not create or execute the underlying obligation. | A q A Importer Accountable Art. 19: Importer is accountable for ensuring user instructions are available in required language(s); manufacturer creates them, distributor verifies presence. | R i R Distributor Responsible Art. 20: Distributor exercises due care by verifying specific product markings, labelling, and user documentation. | — | — | — |
| Withhold non-compliant product from EU market | R/A r R/A Manufacturer Responsible & Accountable Parallel duty: each operator marked R/A bears this obligation independently for their own supply chain action — not a shared accountability. | I d I Authorised Representative Informed Art. 15: Auth Rep has a limited mandate; informed of the manufacturer's activities but not directly involved in execution. | R/A r R/A Importer Responsible & Accountable Parallel duty: each operator marked R/A bears this obligation independently for their own supply chain action — not a shared accountability. | R/A r R/A Distributor Responsible & Accountable Parallel duty: each operator marked R/A bears this obligation independently for their own supply chain action — not a shared accountability. | — | — | — |
| 24-hour early warning to CSIRT (active exploit) | R/A a R/A Manufacturer Responsible & Accountable Art. 13: Manufacturer bears primary legal obligation for product design, development, production, and lifecycle security. | I d I Authorised Representative Informed Art. 15: Auth Rep has a limited mandate; informed of the manufacturer's activities but not directly involved in execution. | I h I Importer Informed Art. 19: Importer informed of outcomes; no active execution or verification duty for this specific activity. | I j I Distributor Informed Art. 20: Distributor informed; lighter due-care obligations do not require active involvement in this activity. | — | R/A t R/A Open-Source Software Steward Responsible & Accountable Art. 14/24 non-overlapping scopes: Manufacturer reports for commercial products (Art. 14); Steward reports for stewarded OSS (Art. 24). Never the same product. | — |
| 72-hour vulnerability notification to CSIRT | R/A a R/A Manufacturer Responsible & Accountable Art. 13: Manufacturer bears primary legal obligation for product design, development, production, and lifecycle security. | I d I Authorised Representative Informed Art. 15: Auth Rep has a limited mandate; informed of the manufacturer's activities but not directly involved in execution. | I h I Importer Informed Art. 19: Importer informed of outcomes; no active execution or verification duty for this specific activity. | I j I Distributor Informed Art. 20: Distributor informed; lighter due-care obligations do not require active involvement in this activity. | — | R/A t R/A Open-Source Software Steward Responsible & Accountable Art. 14/24 non-overlapping scopes: Manufacturer reports for commercial products (Art. 14); Steward reports for stewarded OSS (Art. 24). Never the same product. | — |
| Release security updates & patches | R/A a R/A Manufacturer Responsible & Accountable Art. 13: Manufacturer bears primary legal obligation for product design, development, production, and lifecycle security. | I d I Authorised Representative Informed Art. 15: Auth Rep has a limited mandate; informed of the manufacturer's activities but not directly involved in execution. | I h I Importer Informed Art. 19: Importer informed of outcomes; no active execution or verification duty for this specific activity. | I j I Distributor Informed Art. 20: Distributor informed; lighter due-care obligations do not require active involvement in this activity. | — | I p I Open-Source Software Steward Informed Art. 24: Steward informed of activities relevant to stewarded components; no active execution duty. | — |
| Report upstream vulns in 3rd-party components | R/A a R/A Manufacturer Responsible & Accountable Art. 13: Manufacturer bears primary legal obligation for product design, development, production, and lifecycle security. | I d I Authorised Representative Informed Art. 15: Auth Rep has a limited mandate; informed of the manufacturer's activities but not directly involved in execution. | I h I Importer Informed Art. 19: Importer informed of outcomes; no active execution or verification duty for this specific activity. | I j I Distributor Informed Art. 20: Distributor informed; lighter due-care obligations do not require active involvement in this activity. | — | C u C Open-Source Software Steward Consulted Art. 14(3) vs Art. 24: Manufacturer has strict legal duty to report upstream; Steward fosters voluntary sharing culture — a lesser, policy-based obligation. | — |
| Cybersecurity policy for secure development | — | — | — | — | — | R/A n R/A Open-Source Software Steward Responsible & Accountable Art. 24: OSS Steward bears direct obligation under its light-touch regulatory regime. | — |
| Vulnerability handling & disclosure process | C v C Manufacturer Consulted Manufacturer provides information, technical cooperation, or access to documentation when requested by other parties or authorities. | — | — | — | — | R/A n R/A Open-Source Software Steward Responsible & Accountable Art. 24: OSS Steward bears direct obligation under its light-touch regulatory regime. | — |
| Cooperation with market surveillance authorities | R/A w R/A Manufacturer Responsible & Accountable Each economic operator must independently cooperate with MSAs when requested. Manufacturer is primary respondent; others respond to requests directed at them. | R w R Authorised Representative Responsible Each economic operator must independently cooperate with MSAs when requested. Manufacturer is primary respondent; others respond to requests directed at them. | R w R Importer Responsible Each economic operator must independently cooperate with MSAs when requested. Manufacturer is primary respondent; others respond to requests directed at them. | R w R Distributor Responsible Each economic operator must independently cooperate with MSAs when requested. Manufacturer is primary respondent; others respond to requests directed at them. | C l C Notified Body Consulted NB reviews relevant documentation (risk assessments, SBOMs, technical files) as input to its assessment activities. | R w R Open-Source Software Steward Responsible Each economic operator must independently cooperate with MSAs when requested. Manufacturer is primary respondent; others respond to requests directed at them. | — |
| White-label / own-brand — full Mfr obligations | R/A s R/A Manufacturer Responsible & Accountable Art. 21 conditional: R/A applies only to the party that triggers the role transition (white-labelling or substantial modification), not all simultaneously. | I d I Authorised Representative Informed Art. 15: Auth Rep has a limited mandate; informed of the manufacturer's activities but not directly involved in execution. | R/A s R/A Importer Responsible & Accountable Art. 21 conditional: R/A applies only to the party that triggers the role transition (white-labelling or substantial modification), not all simultaneously. | R/A s R/A Distributor Responsible & Accountable Art. 21 conditional: R/A applies only to the party that triggers the role transition (white-labelling or substantial modification), not all simultaneously. | — | — | — |
| Substantial modification — full Mfr obligations | R/A s R/A Manufacturer Responsible & Accountable Art. 21 conditional: R/A applies only to the party that triggers the role transition (white-labelling or substantial modification), not all simultaneously. | I d I Authorised Representative Informed Art. 15: Auth Rep has a limited mandate; informed of the manufacturer's activities but not directly involved in execution. | R/A s R/A Importer Responsible & Accountable Art. 21 conditional: R/A applies only to the party that triggers the role transition (white-labelling or substantial modification), not all simultaneously. | R/A s R/A Distributor Responsible & Accountable Art. 21 conditional: R/A applies only to the party that triggers the role transition (white-labelling or substantial modification), not all simultaneously. | — | — | — |
Activity Footnotes
† Important Class I: NB is R/A only when the manufacturer has not applied harmonised standards. If harmonised standards are fully applied, the manufacturer may self-assess and NB is not involved.
‡ Critical / Annex IV: The CRA prioritises EU Cybersecurity Certification Schemes. Standard NB conformity assessment (Module H or B+C) is a fallback when no applicable certification scheme exists.
Cell Assignment Footnotes (a–y)
a Art. 13: Manufacturer bears primary legal obligation for product design, development, production, and lifecycle security.
b Art. 13/32: Manufacturer executes the obligation; Notified Body holds accountability for evaluating and certifying the assessment outcome.
c Art. 15(2): Auth Rep is mandated to keep technical documentation and EU DoC at the disposal of market surveillance authorities on the manufacturer's behalf.
d Art. 15: Auth Rep has a limited mandate; informed of the manufacturer's activities but not directly involved in execution.
e Art. 15: Auth Rep consulted on market access documentation; does not create or execute the underlying obligation.
f Art. 19: Importer bears independent due-diligence gateway duty. This is verification of the existence and completeness of compliance, not a technical re-evaluation of quality.
g Art. 19: Importer consulted as a supply chain stakeholder during the manufacturer's pre-market activities.
h Art. 19: Importer informed of outcomes; no active execution or verification duty for this specific activity.
i Art. 20: Distributor exercises due care by verifying specific product markings, labelling, and user documentation.
j Art. 20: Distributor informed; lighter due-care obligations do not require active involvement in this activity.
k Art. 47: Notified Body executes and is accountable for the conformity assessment procedure and/or its ongoing monitoring.
l NB reviews relevant documentation (risk assessments, SBOMs, technical files) as input to its assessment activities.
m NB informed of ongoing changes that may affect the validity of issued certificates.
n Art. 24: OSS Steward bears direct obligation under its light-touch regulatory regime.
o Art. 24: Steward consulted as ecosystem participant or source of open-source components integrated by manufacturers.
p Art. 24: Steward informed of activities relevant to stewarded components; no active execution duty.
q Art. 19: Importer is accountable for ensuring user instructions are available in required language(s); manufacturer creates them, distributor verifies presence.
r Parallel duty: each operator marked R/A bears this obligation independently for their own supply chain action — not a shared accountability.
s Art. 21 conditional: R/A applies only to the party that triggers the role transition (white-labelling or substantial modification), not all simultaneously.
t Art. 14/24 non-overlapping scopes: Manufacturer reports for commercial products (Art. 14); Steward reports for stewarded OSS (Art. 24). Never the same product.
u Art. 14(3) vs Art. 24: Manufacturer has strict legal duty to report upstream; Steward fosters voluntary sharing culture — a lesser, policy-based obligation.
v Manufacturer provides information, technical cooperation, or access to documentation when requested by other parties or authorities.
w Each economic operator must independently cooperate with MSAs when requested. Manufacturer is primary respondent; others respond to requests directed at them.
x Manufacturer/operators informed of NB actions (suspension, withdrawal) affecting their product's certification status.
y Art. 15(1): Auth Rep consulted on EU DoC but does not draw it up; role limited to retention and making available to authorities.
Important Notes
- ● OSS Volunteer column is fully exempt (—) per Recital 18: non-commercial FOSS contributors are outside CRA scope.
- ● Penalties: up to €15 million or 2.5% of global turnover. OSS Stewards exempt from administrative fines (Art. 64(10)).
- ● Vulnerability reporting (Art. 14) is submitted to CSIRTs via the ENISA single reporting platform; Market Surveillance Authorities (Art. 52–60) enforce compliance and can order corrective actions/recalls.
- ● Where a row shows R/A for more than one role, each party is individually R/A for their own scope. This differs from standard RACI (one A per row) because the CRA creates parallel legal duties.
CRA Obligations
Detailed breakdown of obligations for each supply chain role.
View Obligations Overview →