Article 23 — Identification of economic operators

Cyber Resilience Act (CRA) · Chapter II

Economic operators shall, on request, provide the market surveillance authorities with the following information:

(a)
the name and address of any economic operator who has supplied them with a product with digital elements;

(b)
where available, the name and address of any economic operator to whom they have supplied a product with digital elements.

Economic operators shall be able to present the information referred to in paragraph 1 for 10 years after they have been supplied with the product with digital elements and for 10 years after they have supplied the product with digital elements.

In practiceMeroi Security’s note, not part of the regulation

Article 23(2) sets 10 years running in both directions. The Blue Guide supplies the practical edges. The end user is not covered by the requirement, since a consumer is not considered to be an economic operator. The way to comply is not prescribed by Union harmonisation legislation, though market surveillance authorities can ask for relevant documents, including invoices, allowing the origin of the product to be traced, so it could be useful to keep invoices for a longer period than accounting legislation envisages. Those practical points come from the Blue Guide and are not mandated by the CRA.

Source: the Regulation, Article 23; Blue Guide 2022 (2022/C 247/01) §4.2.2.6, horizontal product-law guidance that predates the CRA

General information. This does not constitute legal advice.