The Role That Doesn’t Transfer - CRA manufacturer obligations across acquisitions, carve-outs, rebrands and insolvency

EXECUTIVE BRIEF. This article discusses the impact when manufacturers of CRA impacted products transition.

The EU Cyber Resilience Act hangs every obligation on a single role, the manufacturer, and says almost nothing about what happens when the company holding that role is sold, split, rebranded or wound up. In operational technology, where assets outlive the companies that made them, that silence is a liability someone is already carrying. Usually it is the buyer, and usually they do not know it.

The orphan

Consider a vendor we will not name. It is listed in Asia, it has spent the better part of two decades building something genuinely hard: software that reads the programs inside multi-brand PLCs and traces a line stoppage to the rung, contact and interlock that caused it. Its references are automotive and electronics plants most engineers would recognise. Its European product ships on an appliance built by a European partner. And its revenue has roughly halved in a year, its losses are widening, and its stock exchange has told it that its market value is below the floor for remaining listed.

None of that is unusual. Small, technically excellent OT software companies run out of money all the time. What is new is the regulatory frame around the appliances they leave behind. From 11 December 2027, a product with digital elements placed on the EU market carries a support period of at least five years. Within it, the manufacturer must handle vulnerabilities and supply security updates, each kept available for at least ten years. Since 11 September 2026 it has also had to report actively exploited vulnerabilities within 24 hours.

So ask the operational question: If that vendor fails next year, who patches the appliance sitting in an EU plant, reading that plant’s PLC programs? Who receives the vulnerability report? Who files the 24-hour notification? The regulation’s answer is: nobody is obliged to. The manufacturer must tell the authorities and its users that it is stopping, and that is substantially all.

Insolvency is the vivid case, and it is where this piece will end. But it is the rare case. The same gap opens, more quietly and far more often, every time an OT product changes hands: in carve-outs, asset sales, rebrands, product-line exits and the sale of a non-EU parent. The CRA attaches its obligations to a role. Corporate events move products, code, people and brands. Nothing in the regulation moves the role with them.

A role, not a company

The CRA defines the manufacturer by function. It is a person who develops or manufactures products with digital elements, or has them designed, developed or manufactured and markets them under its own name or trademark. The definition does not care about corporate form, ownership or group structure. It cares about two things: who makes the product and whose name is on it.

The obligations then attach to a moment, placing on the market, defined as the first making available of a product on the EU market. The CRA sits inside the legislative framework and annunciated through the Commission’s Blue Guide which guides this as unit by unit, where placing on the market “refers to each individual product, not to a type of product”. Each unit shipped starts its own obligations, under whichever manufacturer held the role on the day it shipped.

This is a clean design for a world where manufacturers are permanent. It is an awkward one for the world OT actually lives in. A distributed control system, a safety PLC or an edge appliance in a process plant routinely runs fifteen to twenty-five years. The CRA’s own floor is a five-year support period, longer where expected use is longer, and industrial systems are exactly the case the recitals flag for longer periods. Across a fifteen-year support period, the odds that the manufacturer of record is the same legal entity, with the same owners, team and code base, at the end as at the start, are not high.

The regulation has detailed rules for who becomes a manufacturer: importers and distributors who rebrand or substantially modify, and anyone else who substantially modifies. It has notification rules for when a manufacturer stops. What it does not have is a rule for handing the role over: no succession, no novation, no assumption of obligations by an acquirer. Every transition below falls into that gap unique to the circumstances. Here we summarize the contract fix applicable to it.

Transition	Who holds the role the day after	Where it breaks	Contract fix
Share acquisition	Same legal entity; obligations persist	Integration dismantles the vulnerability-handling process and contact point	Treat Arts. 13–14 processes as day-one critical in the integration plan
Asset sale or carve-out	Seller for units placed before closing; buyer for units it places after	Duty stays with seller; capability goes to buyer; the TSA expires long before the support period	Vulnerability-handling TSA to end of support, or contractual assumption by the buyer
Rebrand, white-label, OEM	Brand owner (Arts. 3(13), 21)	OEM process and SBOM not flowed down to the brand owner	Flow-down of SBOM, vulnerability intake and update supply; audit rights
Integrator takes over code	Becomes manufacturer on substantial modification (Art. 22)	The best-placed rescuer inherits Arts. 13–14	Security-only scope (Recital 39), or accept the role knowingly
Product-line end-of-life	Original manufacturer until support periods end (Art. 13(8)–(9))	Team disbanded, obligation unfunded	Ring-fenced sustainment budget; end-of-support source release (Recital 61)
Non-EU parent sold or failed	Non-EU manufacturer; authorized representative barred from core duties (Art. 18(2))	No party in the EU is able to patch	EU manufacturer of record, or escrow with an EU custodian
Insolvency	Nobody; notification only (Arts. 13(23), 19(8), 20(6))	No one is obliged to continue	Escrow with reproducible build, released on insolvency, delisting or an Art. 13(23) notice

Nexus Engineering Partners has developed a playbook for each of these situations and can help to provide guidance for contract articulation when manufacturer transition occurs. Nexus can help to provide guidance and engineering due diligence to limit surprises for CRA compliance and other product related and engineering organization transition events.