Article 14 reporting starts 11 September 2026.See what you need in place

Who it is for

alloy-it is CRA operations for the manufacturer of record, and for anyone the regulation treats as that manufacturer. The cards below are how that looks in different teams and product types.

Built for the manufacturer of record

The CRA names several economic operators. alloy-it is the operations platform for the organisation that placed the product on the Union market, and for anyone the regulation treats as that manufacturer.

For you

Manufacturer

Articles 13 and 14

You develop or manufacture products with digital elements, or have them designed and made, and place them on the EU market under your name or trademark. That includes own-brand and white-label: if it ships under your name, you are the manufacturer, even if a contract manufacturer built it. Security by design, risk assessment, vulnerability handling, the support period, and reporting to ENISA and your national CSIRT sit with you. That is the loop alloy-it runs.

Also for you

Substantial modifier

Treated as a manufacturer

You change a product already on the market in a way that affects its cybersecurity, then make that modified product available. The CRA treats you as a manufacturer for the part you changed, or for the whole product if the change touches security as a whole. Same inventory, same Article 14 clock, same rebuild path.

Other CRA roles, other products

Those operators have real CRA duties. They are not the manufacturer operations loop. alloy-it is not built for them unless they also manufacture or substantially modify.

Authorised representative
You hold a written mandate to keep the EU declaration of conformity and technical documentation at the disposal of market surveillance. The mandate cannot cover design, production, or quality monitoring. The manufacturer still needs the operations loop.
Importer
You place on the Union market a product that bears the name of a manufacturer established outside the Union. You must verify that manufacturer assessed conformity, keep the declaration, and withhold non-compliant products. You do not become the ops owner unless you also put your own name on the product or substantially modify it.
Distributor
You make a product available without affecting its properties. Due care, CE marking checks, and cooperation with authorities. Not a living product inventory.
Open-source steward or contributor
Stewards have a lighter policy and cooperation duty and cannot affix CE marking. Contributors are outside the CRA when the component is not under their direct responsibility. If you place free and open-source software on the market commercially under your name, you are a manufacturer, and then this is for you.
Notified body, market surveillance, CSIRT, ENISA
You assess, supervise, or receive reports. alloy-it is not a notified body, not CE-marking software, and does not submit filings to ENISA or national CSIRTs.

This is general information about CRA roles, not legal advice. Your counsel decides which operator you are.

See it on your kind of product

Start free with a product inventory, or book a CRA walkthrough.