Ask a Nemko Expert
THIS WEEK'S QUESTION - October 28, 2026
QUESTION:
We’re a system integrator, not a manufacturer. We combine hardware and software from different suppliers into one complete solution for our customers. Do we still need to comply with the EU Cyber Resilience Act (CRA), or is compliance the responsibility of the original manufacturers?
Answer from Pepijn Van Der Laan, Global Technical Director, Nemko Digital:
The answer is: It depends on your role.
Potentially yes: If you market an integrated product with digital elements under your own name or substantially modify an existing product and make it available on the EU market, you may assume manufacturer responsibilities.
But not necessarily: If you only install or configure existing products for customers without placing a new product on the market or substantially modifying one, manufacturer obligations may not apply.
Important to consider: Using compliant components does not automatically establish compliance of the finished integrated product.
Your Question Could Be Our Next Expert Answer
Every product, market, and compliance journey is different. That's why we're answering the questions manufacturers are asking.
Your trusted partner and advisor for safety
Since 1933, Nemko has ensured that customers comply with new and existing requirements anywhere in the world. With their recognized cyber security expertise paired with active involvement in standards development and implementation, Nemko is proud to offer a global, single source solution for testing and product certification.
