The extension store doesn't decide who's the manufacturer
A paid browser extension sold on the Chrome Web Store is still a manufacturer under Article 3(13), no different from selling it yourself.
A developer I talked to sells a password-manager add-on through the Chrome Web Store. He asked whether being distributed by Google changes anything about his obligations under the Cyber Resilience Act.
It doesn't. The store is only a distribution channel, and that doesn't shield him from the definition below.
Who the regulation looks at
Article 3(13) defines a manufacturer as whoever develops or has a product developed and markets it under their own name or trademark, whether the product is paid, free, or monetised another way. Article 3(22) adds that this has to happen in the course of a commercial activity.
The extension carries his name in the listing. He wrote the code. He set the price. That's enough. Whether users install it from his own site, from GitHub, or from a marketplace run by a company with far more lawyers than he has doesn't move him out of that definition.
Compare that to someone who builds a browser store's own bundled tools under the store owner's name. That person isn't the manufacturer. The name on the product is what matters, not who hosts the download.
What's live now, what isn't yet
Since 11 September 2026, Article 14 applies. If he learns his extension has an actively exploited vulnerability, he has 24 hours to send an early warning to his CSIRT and ENISA, then 72 hours for the full notification. That clock starts the moment he knows, not when the store flags it, not when a user emails him.
The rest of the regulation, the SBOM under Annex I, the technical documentation in Annex VII, the EU declaration of conformity in Annex V, applies from 11 December 2027, under Article 71. Fines under Article 64 start the same date.
A store listing doesn't push any of these dates back. It also doesn't add extra ones. The obligations attach to him as the manufacturer, not to the distribution model he picked.
The part he can check today
What actually decides his situation is whether he's a manufacturer at all, not where he sells. That depends on details like commercial activity, who wrote the manifest, and what name is on it. That's what the scope test walks through, case by case: https://crakit.eu/scope/
Not legal advice.
This is not legal advice.