Built for the manufacturer of record
The CRA names several economic operators. alloy-it is the operations platform for the organisation that placed the product on the Union market, and for anyone the regulation treats as that manufacturer.
For you
Manufacturer
Articles 13 and 14
You develop or manufacture products with digital elements, or have them designed and made, and place them on the EU market under your name or trademark. That includes own-brand and white-label: if it ships under your name, you are the manufacturer, even if a contract manufacturer built it. Security by design, risk assessment, vulnerability handling, the support period, and reporting to ENISA and your national CSIRT sit with you. That is the loop alloy-it runs.
Also for you
Substantial modifier
Treated as a manufacturer
You change a product already on the market in a way that affects its cybersecurity, then make that modified product available. The CRA treats you as a manufacturer for the part you changed, or for the whole product if the change touches security as a whole. Same inventory, same Article 14 clock, same rebuild path.