Comply.Land warns emergency fixes can trigger CRA manufacturer duties

Comply.Land has published a new guide on when a break-glass fix to someone else’s product can make an integrator, MSP or reseller a manufacturer under the EU Cyber Resilience Act. The dossier lands as CRA reporting duties are now live and full product compliance is set to tighten in 2027.

Why it matters: - Emergency patches can move a downstream company into the legal role of manufacturer under the EU Cyber Resilience Act. - That shift can trigger full CRA obligations, including technical documentation and vulnerability reporting. - The issue is urgent because CRA reporting duties are already in force and broader compliance deadlines are still ahead.

What happened: - Comply.Land published a new dossier on October 6, 2026, focused on emergency modifications to products the responder did not originally make. - The dossier asks when a break-glass fix can cause an integrator, managed-service provider or software reseller to become the manufacturer under EU law. - The guide is titled “Downstream Post-Market Modification and Break-Glass Agreements.” - Daniel Thompson-Yvetot authored the dossier. - Comply.Land is based in Malta and focuses on compliance infrastructure for the EU Cyber Resilience Act.

The details: - Article 22 of the CRA can treat a party that makes a substantial change to a product and places it back on the market as the manufacturer. - That status can apply to the changed portion of the product, and in some cases to the full product. - Manufacturer status brings the obligations in Articles 13 and 14, including technical documentation and vulnerability reporting. - The CRA entered into force on December 10, 2024, starting a 36-month transition period for manufacturers. - Notified bodies began being designated on June 11, 2026, allowing third-party assessments. - CRA reporting obligations took effect on September 11, 2026. - Those reporting rules require manufacturers to report actively exploited vulnerabilities and serious incidents to ENISA and national CSIRTs within 24 hours of becoming aware of them. - The new Product Liability Directive must be implemented by December 9, 2026, and extends strict liability to faulty software. - Full CRA application begins on December 11, 2027. - From that date, all products with digital elements placed on the EU market must carry a CE mark and full technical documentation. - The dossier recommends that organizations pre-negotiate a “break-glass” agreement. - Such an agreement should authorize emergency measures in advance, assign CRA responsibilities before an incident, and define the path back to the original manufacturer’s supported product. - The dossier is the third installment in Comply.Land’s weekly “CRA Fringe” series. - Earlier editions covered the 24-hour, 72-hour and 14-day reporting cascade for actively exploited vulnerabilities. - Earlier editions also addressed whether a manufacturer’s reporting duty under Article 14 continues after product support ends.

Between the lines: - The guide reflects a practical problem in CRA compliance: fast incident response can create legal exposure if the responder crosses the line from fixer to manufacturer. - The emphasis on prearranged agreements suggests Comply.Land sees contractual planning as the cleanest way to avoid disputes during a live security event. - Thompson-Yvetot framed the series as a way to answer edge cases the regulation does not spell out clearly. - He said the hard part is often not fixing the problem, but figuring out afterward who has become the manufacturer.

What's next: - Comply.Land is making the dossier available immediately through its site. - The company points readers to additional CRA Fringe dossiers in its shop. - More organizations are likely to revisit incident-response contracts as the CRA’s 2026 and 2027 deadlines approach.

The bottom line: - In the CRA era, an emergency fix is not just a technical act. It can also be a regulatory trigger.