Comply.Land flags emergency fixes as a potential manufacturer trigger under EU cyber law

Comply.Land has published new guidance on when an emergency fix to a product made by another company can make the fixer a manufacturer under the EU Cyber Resilience Act. The dossier is aimed at integrators, managed-service providers and software vendors facing new reporting and liability duties as CRA deadlines roll in.

Why it matters: - Emergency fixes are no longer just an engineering issue under the EU Cyber Resilience Act. - A company that patches someone else’s product can, in some cases, inherit manufacturer-level obligations for the part it changed or even the full product. - That shift affects reporting duties, technical documentation and liability exposure for integrators, service providers and software vendors.

What happened: - Comply.Land published a new dossier on 6 October 2026 in Birgu, Malta. - The dossier addresses whether an emergency change to a product not originally manufactured by the fixer can trigger manufacturer status under the EU Cyber Resilience Act. - The publication is titled “Downstream Post-Market Modification and Break-Glass Agreements”. - Daniel Thompson-Yvetot prepared the dossier. - Comply.Land says the guide is the third release in its weekly CRA Fringe series.

The details: - The CRA entered into force on 10 December 2024 and started a 36-month transition period for manufacturers. - Notifications of Conformity Assessment Bodies began on 11 June 2026. - CRA reporting obligations took effect on 11 September 2026. - Those obligations require manufacturers to report actively exploited vulnerabilities and severe incidents to ENISA and national CSIRTs within 24 hours of becoming aware of them. - The Product Liability Directive transposition deadline falls on 9 December 2026. - Full CRA application arrives on 11 December 2027. - By that date, products with digital elements placed on the EU market must carry complete technical documentation and the CE marking. - Manufacturers must also have EU representation through their own office, an Authorised Representative, Importer or Distributor. - Under Article 22, a party other than the original manufacturer, importer or distributor that makes a substantial modification and places the product on the market can be treated as a manufacturer. - That status can apply to the modified part or, in some cases, the whole product. - The associated Article 13 and Article 14 duties include technical documentation and vulnerability-reporting obligations. - The dossier recommends a break-glass agreement set up in advance. - The recommended framework would pre-authorise emergency actions, assign CRA obligations before an incident and define the path back to the original manufacturer’s supported product. - Earlier CRA Fringe issues covered the 24-hour, 72-hour and 14-day reporting cascade for actively exploited vulnerabilities. - Earlier issues also examined whether a manufacturer’s Article 14 reporting duty continues after a product’s support period ends.

Between the lines: - The dossier targets a gray area the CRA does not spell out cleanly: what happens after an emergency patch changes legal responsibility. - The practical risk is that an incident-response decision can create compliance duties after the fact, when there is no time left to negotiate roles. - Pre-agreed break-glass terms are meant to reduce that uncertainty before a security event forces a fast fix. - Daniel Thompson-Yvetot said the hard part can be figuring out afterward who became a manufacturer, and the dossier is meant to answer questions the regulation does not clearly cover.

What's next: - Comply.Land is making the dossier available now through its website. - The company also offers access to all available dossiers on its shop page. - More CRA Fringe releases are likely as the regulation’s remaining deadlines approach. - More information