Selling from outside the EU doesn't exempt you from the CRA
A developer based outside the EU selling to European customers is still a manufacturer under Article 3, with the same 24-hour and 72-hour clocks as anyone in th
Picture a developer based outside the EU who builds a command-line security tool and sells it to companies across the EU. Being outside the Union feels like it should change something under the Cyber Resilience Act.
It doesn't take him out of scope.
Where you sit doesn't change the target
Article 3(13) defines a manufacturer as whoever develops a product and markets it under their own name or trademark, in the course of a commercial activity under Article 3(22). Nothing in that definition mentions where the developer lives or where the company is registered. What matters is whether the product with digital elements reaches the EU market.
His tool does. European customers buy it, install it, and run it. That's enough to put him inside the regulation, the same way it would if he lived in Lyon instead of somewhere outside the EU.
The option he actually has
Article 18 gives non-EU manufacturers something EU-based ones don't need: the option to appoint an authorised representative inside the Union. It's optional, not required. Skipping it doesn't remove his obligations. It just means he handles them directly instead of through a local representative.
The clocks already run
Since 11 September 2026, Article 14 applies to him exactly as it applies to a developer in Berlin. If he learns that an actively exploited vulnerability affects his tool, he has 24 hours to send an early warning to the CSIRT designated as coordinator and to ENISA, then 72 hours for the full notification. The clock starts the moment he knows, not when a customer emails him, not when he registers with anyone.
The rest of the regulation, the SBOM under Annex I, the technical documentation in Annex VII, the declaration of conformity in Annex V, applies from 11 December 2027, under Article 71. Fines under Article 64 start the same date. Where he's based changes none of these dates.
What to check before assuming otherwise
Being outside the EU feels like it should matter. It doesn't change who counts as a manufacturer, and it doesn't shift any deadline. What does change the picture is the product itself: whether it's sold under his name, whether it's commercial, whether it reaches EU users. That's what decides the case, one detail at a time. The scope test walks through it: https://crakit.eu/scope/
Not legal advice.
This is not legal advice.