> For the complete documentation index, see [llms.txt](https://www.mica.wtf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.mica.wtf/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/19.md). # Art. 19 — Obligations of importers CRA Article 19 — Obligations of importers. Regulation (EU) 2024/2847, Chapter II — Obligations of economic operators and provisions in relation to free and open-source software. 1. Importers shall place on the market only products with digital elements that comply with the essential [cybersecurity](https://headlesslaw.com/definitions/cra/cybersecurity/) requirements set out in Part I of Annex I and where the processes put in place by the [manufacturer](https://headlesslaw.com/definitions/cra/manufacturer/) comply with the essential cybersecurity requirements set out in Part II of Annex I. 2. Before placing a [product with digital elements](https://headlesslaw.com/definitions/cra/product-with-digital-elements/) on the market, importers shall ensure that: 1. the appropriate [conformity assessment](https://headlesslaw.com/definitions/cra/conformity-assessment/) procedures as referred to in [Article 32](/cra/chapter-iii-conformity-of-the-product-with-digital-elements-art.-27-34/32.md) have been carried out by the manufacturer; 2. the manufacturer has drawn up the technical documentation; 3. the product with digital elements bears the [CE marking](https://headlesslaw.com/definitions/cra/ce-marking/) referred to in [Article 30](/cra/chapter-iii-conformity-of-the-product-with-digital-elements-art.-27-34/30.md) and is accompanied by the EU declaration of conformity referred to in [Article 13(20)](/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/13.md) and the information and instructions to the user as set out in Annex II in a language which can be easily understood by users and market surveillance authorities; 4. the manufacturer has complied with the requirements set out in [Article 13(15)](/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/13.md), (16) and (19). For the purposes of this paragraph, importers shall be able to provide the necessary documents proving the fulfilment of the requirements set out in this Article. 3. Where an [importer](https://headlesslaw.com/definitions/cra/importer/) considers or has reason to believe that a product with digital elements or the processes put in place by the manufacturer are not in conformity with this Regulation, the importer shall not place the product on the market until that product or the processes put in place by the manufacturer have been brought into conformity with this Regulation. Furthermore, where the product with digital elements presents a [significant cybersecurity risk](https://headlesslaw.com/definitions/cra/significant-cybersecurity-risk/), the importer shall inform the manufacturer and the market surveillance authorities to that effect. Where an importer has reason to believe that a product with digital elements may present a significant [cybersecurity risk](https://headlesslaw.com/definitions/cra/cybersecurity-risk/) in light of non-technical risk factors, the importer shall inform the market surveillance authorities to that effect. Upon receipt of such information, the market surveillance authorities shall follow the procedures referred to in [Article 54(2)](/cra/chapter-v-market-surveillance-and-enforcement-art.-52-60/54.md). 4. Importers shall indicate their name, registered trade name or registered trademark, the postal address, email address or other digital contact as well as, where applicable, the website at which they can be contacted on the product with digital elements or on its packaging or in a document accompanying the product with digital elements. The contact details shall be in a language easily understood by users and market surveillance authorities. 5. Importers who know or have reason to believe that a product with digital elements which they have placed on the market is not in conformity with this Regulation shall immediately take the corrective measures necessary to ensure that the product with digital elements is brought into conformity with this Regulation, or to withdraw or recall the product, if appropriate. Upon becoming aware of a vulnerability in the product with digital elements, importers shall inform the manufacturer without undue delay about that vulnerability. Furthermore, where the product with digital elements presents a significant cybersecurity risk, importers shall immediately inform the market surveillance authorities of the Member States in which they have made the product with digital elements available on the market to that effect, giving details, in particular, of non-compliance and of any corrective measures taken. 6. Importers shall, for at least 10 years after the product with digital elements has been placed on the market or for the support period, whichever is longer, keep a copy of the EU declaration of conformity at the disposal of the market surveillance authorities and ensure that the technical documentation can be made available to those authorities, upon request. 7. Importers shall, further to a reasoned request from a market surveillance authority, provide it with all the information and documentation, in paper or electronic form, necessary to demonstrate the conformity of the product with digital elements with the essential cybersecurity requirements set out in Part I of Annex I as well as of the processes put in place by the manufacturer with the essential cybersecurity requirements set out in Part II of Annex I in a language that can be easily understood by that authority. They shall cooperate with that authority, at its request, on any measures taken to eliminate the cybersecurity risks posed by a product with digital elements, which they have placed on the market. 8. Where the importer of a product with digital elements becomes aware that the manufacturer of that product has ceased its operations and, as result, is not able to comply with the obligations laid down in this Regulation, the importer shall inform the relevant market surveillance authorities about this situation, as well as, by any means available and to the extent possible, the users of the products with digital elements placed on the market. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.mica.wtf/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/19.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.