The first time I sat down with Regulation (EU) 2024/2847 and read it cover to cover, the thing that surprised me wasn’t the scope. The scope I expected. Anyone who tracks European cybersecurity policy could see the CRA coming five years out. What surprised me was the weight distribution. Most regulations are evenly loaded — a hundred articles, each carrying its own piece of the legal cargo. The CRA is not built that way.
Article 13 carries most of it.
Twenty-five paragraphs. Every one of them imposes an obligation on the manufacturer or anchors a Commission power that creates one. No other article in the CRA comes close. Article 14 has ten paragraphs. Article 19 — importer obligations — has eight. Article 20 — distributors — six. Article 32, the conformity assessment routing engine, six. The Annex I essential requirements, which feel weighty when you read them, fit on a page and a half: thirteen sub-points in Part I, eight numbered points in Part II. Article 13 is structurally a different kind of object. It is the load-bearing wall of the building.
I want to explain why I think this matters, and why anyone whose job touches CRA compliance — manufacturer, importer, notified body, in-house counsel — should treat Article 13 differently from the rest of the regulation.
§ 01What “load-bearing” actually means
Architecture has a useful concept here. In a load-bearing wall structure, certain walls hold up everything else; remove them and the building collapses. Other walls are partition walls — they divide rooms but support nothing. You can knock them down with a sledgehammer and the roof stays where it is.
Most regulatory articles are partition walls. They define a procedure, a deadline, an exception. They matter, but they refer outward — to other articles, to annexes, to delegated acts. Read in isolation, they feel incomplete, because they are. They’re part of a larger structure.
Article 13 is different. Article 13 doesn’t refer outward. Other articles refer to it. When Article 14 talks about the manufacturer’s reporting obligations, it sits on top of Article 13’s definition of what the manufacturer is and what the manufacturer must already be doing. When Article 19 specifies importer obligations, those obligations are derivative — the importer’s job is to verify the manufacturer’s compliance with specific paragraphs of Article 13 (Article 19(2)(c) and (d) name Article 13(15), (16), (19), and (20) explicitly). When Article 27 talks about presumption of conformity, the conformity that gets presumed is conformity with Annex I — and Annex I is the substance that Article 13(1) makes mandatory. The whole regulation pivots on this one article.
If you remove Article 13 from the CRA, the CRA does not exist. You have a regulation about market surveillance of nothing in particular.
§ 02The 25 paragraphs, grouped
I read Article 13 the way one reads a building’s structural drawings — not paragraph by paragraph, but in load groups. Six of them.
Group 1: design-time obligations (paragraphs 1, 2, 3). The “before you build the product” rules. Annex I Part I conformity by design (¶1). Cybersecurity risk assessment (¶2), and what that risk assessment must analyse (¶3). They’re structurally first because nothing else can land if the product wasn’t designed for it. You can’t patch security in.
Group 2: supply-chain due diligence (paragraphs 5, 6). Due diligence on third-party components, including open-source components (¶5). Where the manufacturer finds a vulnerability in an integrated component, an obligation to report it back to whoever maintains that component and remediate (¶6). The vulnerability of any included component becomes the manufacturer’s vulnerability. This is the group that should keep APAC contract manufacturers up at night, because a lot of what they ship is integration work.
Group 3: documentation as evidence (paragraphs 4, 7, 13). The risk assessment goes into the technical documentation required by Article 31 and Annex VII (¶4). Vulnerabilities and cybersecurity aspects must be systematically documented and the risk assessment updated (¶7). Technical documentation and the EU declaration of conformity must be kept available to market surveillance authorities for at least ten years or the support period, whichever is longer (¶13). Paperwork-shaped on the surface, but the documents are themselves audit objects.
Group 4: post-market vulnerability handling (paragraphs 8, 9, 10, 11, 21). The support period — at least five years, with the manufacturer determining the actual duration based on expected use time (¶8). Each security update issued during the support period must remain available for at least ten years after issue, or the remainder of the support period, whichever is longer (¶9). For substantially modified software, compliance only required on the latest version, subject to free upgrade conditions (¶10). Where the manufacturer maintains public archives of historical versions, users must be clearly informed about risks of using unsupported software (¶11). Where non-compliance is identified, immediate corrective action, withdrawal, or recall (¶21). This is the group that turns CRA from a one-time certification cost into a perpetual operational cost — and the group that most companies haven’t budgeted for.
Group 5: conformity, CE marking, identification, user-facing artefacts (paragraphs 12, 14, 15, 16, 17, 18, 19, 20). The artefacts you ship with the product. Technical documentation drawn up before market, conformity assessment carried out, EU declaration of conformity, CE marking (¶12). Procedures for series production to remain in conformity (¶14). Type, batch, or serial number for product identification (¶15). Manufacturer name and contact details on the product (¶16). A single point of contact for users to report vulnerabilities (¶17). Information and instructions to the user per Annex II, kept available for ten years or the support period (¶18). End date of the support period clearly specified at time of purchase (¶19). EU declaration of conformity, or simplified DoC per Annex VI, accompanying the product (¶20). It looks like a paperwork group, but every artefact in it is something a market surveillance authority can ask to see.
Group 6: authority interaction and Commission powers (paragraphs 22, 23, 24, 25). On reasoned request from a market surveillance authority, all information and documentation needed to demonstrate conformity (¶22). On cessation of operations, advance notification to authorities and users (¶23). The Commission may, by implementing acts, specify the format and elements of the SBOM referred to in Annex I Part II (¶24). ADCO may decide to conduct a Union-wide dependency assessment, in which case market surveillance authorities can request manufacturers to submit SBOMs (¶25). Most APAC manufacturers underweight this group because it doesn’t show up in conformity assessment artefacts — but it’s where post-market enforcement and Commission rule-making actually bite.
Six groups. Twenty-five paragraphs. One article. Read individually, the paragraphs feel like a checklist. Read as six functional groups, they feel like a coherent operating model — and that’s the right way to read them.
§ 03The asymmetry that makes Article 13 dangerous
Here is the part that surprised me, and the reason I think Article 13 deserves separate treatment from the rest of the regulation.
Most CRA articles fail the manufacturer in specific ways. Miss Article 14’s 24-hour reporting deadline? You’ve breached Article 14. Miss the CE marking rules in Article 30? You’ve breached Article 30. The penalty under Article 64 attaches to the specific failed obligation, the failure is enumerable, and the remediation is bounded.
Article 13 doesn’t work that way. Article 13 fails structurally.
If you missed Group 1 — you didn’t do a risk assessment, your product wasn’t designed against Annex I Part I — every downstream obligation is also breached, because every downstream obligation assumes a product designed against Annex I. Your Article 14 vulnerability and incident reports refer to a product that doesn’t have a documented security baseline. Your Article 27 presumption of conformity presumes nothing. Your Annex VII technical file describes a product whose risk model was never written. The whole stack collapses.
This is what “load-bearing” means in compliance terms. A failure in Article 13 is not a single fine — it’s an unwinding of every claim you’ve made under every other article. Article 64(2) recognises this implicitly: breaches of Article 13 attract the highest penalty tier (up to €15 million or 2.5% of worldwide annual turnover), the same tier as Annex I breaches and Article 14 breaches. The legislator put Article 13 in the maximum bracket because the legislator understood the structural role.
§ 03bThe Article 18 carve-out: what an authorised representative cannot shield
For APAC manufacturers placing products on the EU market, the standard route is appointing an EU-established authorised representative (AR) under Article 18. The AR carries the legal mandate. The AR keeps the EU declaration of conformity available to market surveillance authorities. The AR cooperates with authorities on corrective action.
What the AR cannot carry is most of Article 13. Article 18(2) is explicit: “The obligations laid down in Article 13(1) to (11), Article 13(12), first subparagraph, and Article 13(14) shall not form part of the authorised representative’s mandate.” Read that list carefully. ¶1-3 (design-time). ¶4-7 (documentation and supply chain). ¶8-11 (vulnerability handling and support period). ¶12 first subparagraph (the technical documentation drawing-up itself). ¶14 (series production conformity). All of it sits with the manufacturer, structurally and contractually. The AR cannot stand in for any of it.
This is not a paperwork detail. It means the operational obligations — risk assessment, SBOM, vulnerability handling, support period commitment, series production controls — remain with an entity that may have no establishment, no employees, and no operational presence inside the EU. The AR is a legal contact point. It is not an organisational substitute. A manufacturer in Taipei or Shenzhen who reads Article 13 as something the AR will handle has misread Article 18.
The practical implication: Article 13 has to be implemented in-house, by people who understand the product. The AR mandate is a wrapper around that implementation, not a replacement for it.
§ 03cWhy APAC manufacturers feel this differently
I want to be specific about why this matters more in APAC than in, say, Frankfurt or Helsinki, because the regulation reads identically everywhere but lands differently.
European manufacturers — particularly in regulated sectors like automotive or industrial automation — have decades of experience operating under harmonised conformity regulations. Machine Directive, EMC Directive, RED. They have institutional muscle for risk assessment, technical documentation, market surveillance correspondence. Article 13 reads to them as a familiar pattern with new content.
For most APAC hardware OEMs and ODMs, especially those whose European business has gone through brand-customer importers, Article 13 reads as an entirely new operating model. The Group 1 design-time obligations don’t map onto any existing internal process. The Group 4 post-market obligations don’t map onto any existing budget category. The Group 5 user-facing artefacts and Group 6 authority-cooperation obligations require organisational reach into customer relationships and regulatory communications that contract manufacturers historically didn’t have.
The CRA doesn’t care about this. The CRA applies identically. But the operational gap that has to be closed across the APAC manufacturing belt is genuinely larger than the gap in Stuttgart or Eindhoven. That gap is what Article 13 measures, and Article 13 is the one place in the regulation that measures it.
§ 04The reading strategy I’d recommend
If you have time to read one article of the CRA closely — and most operators don’t have time to read all seventy-one — read Article 13. Not because the others don’t matter, but because the others are conditional on Article 13 being right.
Read it in groups, not in paragraph order. Map each group to an internal owner — Group 1 is engineering, Group 2 is procurement and SBOM, Group 3 is the documentation function (technical writing, regulatory affairs, audit), Group 4 is product security and incident response, Group 5 is regulatory affairs and customer support, Group 6 is regulatory affairs and legal. The mapping won’t be clean in any company below 200 people, and that’s where the gap analysis becomes visible — these obligations don’t have homes yet.
Treat Group 4 as the budget item. Most companies will discover, while reading the paragraphs that mandate vulnerability handling throughout a manufacturer-declared support period of at least five years — with each issued security update remaining available for at least ten years — that they have never priced support into their P&L. The first time someone calculates the carrying cost of supporting a product line at SBOM-level visibility for the support period plus the ten-year update-availability tail, the reaction tends to be physical.
And finally — read Article 13 alongside Article 64. The penalty reference makes the structural role visible. €15 million or 2.5% of turnover is not a parking ticket. It’s a number designed to be larger than the cost of compliance, which is the only way it works as deterrence.
§ 05What this implies for the rest of the project
Most of this site is built around Article-by-article reading, and most of the articles will get a single editorial. Article 13 is the exception. The full editorial sits at /act/article/13, and over the coming weeks I expect to write follow-up commentary on specific paragraphs — particularly paragraph 8 (support period determination), paragraph 24 (SBOM format implementing acts) and paragraph 25 (ADCO Union-wide dependency assessment), and the Group 4 vulnerability handling cluster.
If you only have an hour to spend on the CRA this month, spend it on Article 13. Everything else is downstream.