Cyber Resilience Act › CHAPTER II — OBLIGATIONS OF ECONOMIC OPERATORS AND PROVISIONS IN RELATION TO FREE AND OPEN-SOURCE SOFTWARE 1 Economic operators shall, on request, provide the market surveillance authorities with the following information:
(a) the name and address of any economic operator who has supplied them with a product with digital elements;
(b) where available, the name and address of any economic operator to whom they have supplied a product with digital elements.
2 Economic operators shall be able to present the information referred to in paragraph 1 for 10 years after they have been supplied with the product with digital elements and for 10 years after they have supplied the product with digital elements.
Need help applying this in practice?
Reading the regulation is the easy part. We help manufacturers work out
what it means for a specific product, and what evidence a notified body
will expect.
CRA compliance services
Source and currency. Text of Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements, reproduced from
EUR-Lex
(CELEX 32024R2847) as at 16 August 2026. © European Union,
1998–2026. Reuse is authorised under
the EUR-Lex legal notice .
Only the Official Journal of the European Union is authentic and produces
legal effect. This reader is provided for convenience and does not
constitute legal advice.