Comply.Land flags emergency fixes that can make third-party modifiers “manufacturers” under CRA

Comply.Land has published a new briefing on when an emergency change to a third-party product can trigger manufacturer status under the EU Cyber Resilience Act. The note matters because that designation can pull integrators, managed service providers and software vendors into the CRA’s full documentation and vulnerability-notification duties.

Why it matters: - An emergency patch to someone else’s product can shift legal responsibility under the EU Cyber Resilience Act. - If a modifier is treated as a manufacturer, that party inherits the CRA obligations tied to documentation, vulnerability handling and incident notification. - The issue is especially relevant for integrators, managed service providers and software publishers that intervene under time pressure.

What happened: - Comply.Land published a new dossier on October 6, 2026, in Birgu, Malta, focused on urgent modifications to third-party products. - The dossier asks when a downstream actor that did not make the original product can become a “manufacturer” under the CRA after an emergency intervention. - The report is titled “Downstream Post-Market Modification and Break-Glass Agreements” and was written by Daniel Thompson-Yvetot. - The dossier is available here. - The full CRA Fringe dossier collection is available here.

The details: - The CRA entered into force on December 10, 2024, with a 36-month transition period. - Notification rules for conformity assessment bodies took effect on June 11, 2026. - CRA notification obligations covered in the dossier took effect on September 11, 2026. - Those obligations require manufacturers to report actively exploited vulnerabilities and serious incidents to ENISA and national CSIRTs within 24 hours of becoming aware of them. - A new product-liability directive must be transposed by December 9, 2026, and extends strict liability to software. - The CRA will apply fully on December 11, 2027. - By that date, any product with digital elements placed on the EU market must have complete technical documentation and carry the CE mark. - Article 22 says any person other than the manufacturer, importer or distributor who makes a substantial modification to a product and then places it on the market can be treated as the manufacturer. - That status can apply to the modified part or, in some cases, to the entire product. - The manufacturer designation brings the full obligations in Articles 13 and 14, including technical documentation and vulnerability notification. - The dossier sets out the legal test for deciding when an emergency intervention crosses that threshold. - Comply.Land recommends that organizations put a break-glass agreement in place before any incident. - The agreement is meant to pre-authorize emergency action, allocate CRA duties in advance and define how control returns to the original manufacturer. - The dossier is the third issue in Comply.Land’s weekly CRA Fringe series. - Earlier issues addressed the 24-hour, 72-hour and 14-day notification cascade that starts when a vulnerability is actively exploited. - Previous issues also examined whether Article 14 notification duties continue after the product support period ends.

Between the lines: - The legal risk is not just the fix itself. The bigger issue is who assumes regulator-facing obligations after the fix. - The break-glass approach is a practical compliance tool for incidents where response speed matters more than contract cleanup after the fact. - The dossier reflects a broader gap in the CRA: clear rules on some duties, but harder judgment calls on downstream emergency modifications.

What's next: - Organizations that modify third-party software under emergency conditions will likely need to map who owns CRA duties before incidents occur. - The coming product-liability deadline in December 2026 and full CRA applicability in December 2027 will add pressure to formalize those arrangements now. - Comply.Land’s CRA Fringe series is expected to continue addressing unresolved interpretive questions under the regulation.

The bottom line: - Under the CRA, an emergency patch can do more than fix a vulnerability. It can also turn the fixer into the manufacturer.