Are we the legal manufacturer? How should ODM and OEM contracts allocate CRA responsibilities?
| Business model | CRA role | What the contract must settle |
|---|---|---|
| Own brand | Manufacturer | Full manufacturer obligations: risk assessment, technical documentation, conformity assessment, CE, vulnerability handling and reporting during the support period |
| ODM (you design and make, the customer brands it) | The brand customer is the manufacturer | The risk assessment, technical documentation inputs, SBOM and vulnerability-handling support you provide; scope, support period and reporting-cooperation deadlines |
| OEM (the customer designs, you make) | The brand customer is the manufacturer | Component SBOM, production security and component-check evidence; reporting-cooperation deadlines |
If you also sell the same product in the EU under your own brand, you are the manufacturer for that part. In a company mixing ODM, OEM and own brand, each product line's role is determined separately (the service page maps this to Articles 13, 19, 20, 21 and 22).
A review framework: write cooperation duties as concrete deliverables and deadlines; align the support period with the product's expected use; agree how liability and indemnity are split when non-conformity comes from the other party's design or components. Acceptable terms are for legal counsel to judge case by case.
What fines and regulatory measures can a CRA breach bring?
Fines (Article 64, whichever is higher):
| Paragraph | Breach | Maximum |
|---|---|---|
| 64(2) | Annex I essential requirements, or manufacturer obligations in Article 13 and reporting duties in Article 14 | EUR 15 million or 2.5% of worldwide annual turnover |
| 64(3) | Obligations listed, including Articles 18–23, 28, 30, 31, 32 and 33 | EUR 10 million or 2% |
| 64(4) | Incorrect, incomplete or misleading information in reply to notified bodies or market surveillance authorities | EUR 5 million or 1% |
Market measures: the CRA is enforced by national market surveillance authorities; for non-compliant products they can require corrective action, withdrawal from the market or recall within a reasonable period (Article 54(1)).
Paragraph 4 is a reminder for the General Counsel: every document sent to an authority needs checking. Beyond fines, customer requirements and market access usually bite first.
Reporting duties already apply. Who decides on the 24-hour early warning, and what should legal prepare?
Article 14 has applied since 11 September 2026, including products already on the EU market before 11 December 2027:
| Stage | Actively exploited vulnerability | Severe incident affecting product security |
|---|---|---|
| Early warning | Within 24 hours of becoming aware | Within 24 hours of becoming aware |
| Notification | Within 72 hours of becoming aware | Within 72 hours of becoming aware |
| Final report | Within 14 days after a fix or mitigation is available | Within one month after the 72-hour notification |
A manufacturer without its main establishment in the EU follows the order in Article 14(7) to decide which Member State's coordinator CSIRT to notify, and must also inform affected users (Article 14(8)). Under the Commission's draft guidance, vulnerabilities known to be exploited before 11 September 2026 need not be reported retroactively.
The product security team (PSIRT) leads reporting, with legal, customer service and senior management supporting. Legal should prepare in advance: who is authorised to send within 24 hours, how public statements and user notices are approved, and the record kept when deciding not to report.
Open-source and supplier components: which clauses belong in purchasing contracts?
- Article 13(5): exercise due diligence when integrating third-party components, including open source. The service page suggests writing this due diligence into supplier evaluation criteria and purchasing contracts.
- Article 13(6): when you find a vulnerability in a component, notify the person or entity that manufactures or maintains it.
- Support period: set according to the product's expected use, in principle at least 5 years; each security update stays available for at least 10 years after release or until the end of the support period, whichever is longer.
A framework for purchasing contracts: the supplier's duty and deadlines to provide SBOMs and vulnerability information, whether the component's support period covers the support period you promise customers, notice and alternatives when support ends, and deadlines to cooperate with your Article 14 reports. Public companies already have supplier controls in the purchasing cycle (internal control regulations, Article 7), and the clauses should connect to that cycle; non-public companies may follow this voluntarily.
If a product fails and customers or users claim damages, how does the CRA relate to the new Product Liability Directive?
- The CRA is regulatory law: its sanctions are the administrative fines in Article 64 and market measures.
- Damages: the new Product Liability Directive (EU) 2024/2853 covers software and AI systems and applies to products placed on the market from 9 December 2026; damages are handled under Member State laws transposing it.
- Evidence: CRA risk assessments, technical documentation, SBOMs, vulnerability-handling and reporting records are the record of what was done at placing on the market and during the support period. Whether there is a defect and how liability is allocated is for courts and legal counsel to judge case by case.
In customer contracts, the General Counsel should check that warranty and security-update promises match the support period, whether the liability cap excludes security defects, and whether indemnities from upstream suppliers line up.
When authorities or customers ask for records, which documents must be kept and for how long? Can a certificate replace them?
- Technical documentation and EU declaration of conformity: kept for at least 10 years or the support period, whichever is longer (Article 13(13)).
- Security updates: each stays available for at least 10 years after release or until the end of the support period, whichever is longer (Article 13(9)).
- Vulnerability handling and reporting records: the coordinated vulnerability disclosure policy, vulnerability handling procedure and reporting drill records are deliverables listed on the service page.
No certificate replaces them: there is no standalone "CRA certificate"; products need conformity assessment by category and CE marking. ISO 27001 is not a CRA harmonised standard, and IEC 62443 certification does not create a presumption of conformity either; presumption comes only from harmonised standards published in the Official Journal, common specifications or designated certification schemes (Article 27).
How does Winners Consulting help the General Counsel with the EU CRA?
This is Winners Consulting's own account. Test us with the questions above.
- Who leads: VP- and director-level consultants run every engagement personally and do not outsource; Winners Consulting is an implementation consultant and does not assess
- Category and role: we determine the category per product family and the supply-chain role per product line (manufacturer, importer, distributor; own brand, ODM, OEM), with a documented basis and article reference for each combination
- Reporting first: Article 14 24/72-hour reporting and user-notice process, tabletop exercises, drill records and reporting templates
- Documents and evidence: SBOM and component-check records, the basis for the support period, technical documentation and the EU declaration of conformity
- Phased engagement: excludes actual remediation, test labs and third-party assessment fees; final legal opinions on contracts come from lawyers
- Track record: as of 2026-10, six EU CRA compliance engagements (unnamed under NDA)
- First step: the first mechanism diagnosis is free
More: EU CRA compliance, who should lead CRA, CRA timeline, choosing a CRA consultant, CTO page, product manager page
How other roles see this service
- CEOEU CRA for the CEO: European orders, penalties and ownership. What to decide now
- CISOCISO facing the EU CRA: who leads, 24-hour reporting, SBOM and budget
- CROEU CRA for CROs: how to handle market access risk, reporting and oversight?
- CFOCFO view of the EU CRA and EU AI Act: EU revenue risk, penalties and budgeting
- CTOEU CRA for CTOs: what changes in development, SBOM and launch timing?
- Product managerEU CRA for product managers: is my product in scope, and what must be ready before launch?
Other services for this role
- ISO 37001 for General Counsel: agent bribery, whistleblowing investigations and contract clauses
- Trade secrets for General Counsel: what to prepare for departing employees, lawsuits and evidence preservation
- GDPR and ISO 27701 for General Counsel: processor contracts, transfers and investigations
- EU AI Act and ISO 42001 for General Counsel: roles, AI contracts and liability
- NIS2 for the general counsel: jurisdiction, personal liability, investigations and customer clauses
- DORA for the general counsel: negotiating Article 30 contracts, audit rights and exit
- ERM for the general counsel: putting compliance risk on the risk map and proving effectiveness
- TISAX for the general counsel: OEM contracts, participation terms and sharing results
- ISO 27001 for the general counsel: security clauses, audit rights and incident liability