CE Marking and the EAA Supply Chain: What Manufacturers, Importers, and Distributors Each Actually Owe

The European Accessibility Act is one directive, but it contains two entirely different compliance machines.

If you sell a service into the EU, the machinery is familiar to anyone who has run a web programme. You meet the essential accessibility requirements, you test against EN 301 549, and you publish an accessibility statement explaining how you did it and what still falls short.

If you place a product on the EU market, none of that applies. You enter the European Union's New Legislative Framework: a conformity assessment procedure, a technical documentation file, an EU Declaration of Conformity, a CE mark physically applied to the goods, a five year retention duty, and a positive legal obligation to report your own non-conformity to regulators in every member state where you sold.

Most organisations preparing for the EAA have only ever built the first machine. This article is about the second.

Which products are actually in scope

Article 2 of Directive (EU) 2019/882 lists the products it covers. This is a closed list, not an illustrative one. If your hardware is not on it, the product regime does not apply to you, however digital the product feels.

The list covers:

• Consumer general purpose computer hardware systems and the operating systems that run on them
• Self service terminals, specifically payment terminals, and terminals dedicated to the provision of services covered by the directive: automated teller machines, ticketing machines, check in machines, and interactive information terminals
• Consumer terminal equipment with interactive computing capability used for electronic communications services
• Consumer terminal equipment with interactive computing capability used for accessing audiovisual media services
• E-readers

Note what this catches that teams do not expect. A router or set top box supplied to consumers is terminal equipment. A kiosk in a store lobby that provides travel information is an interactive information terminal. The operating system shipped on a consumer laptop is named in its own right, separately from the hardware.

Note also what it does not catch. A mobile app is a service, not a product, even though it runs on a product. Keeping that line clean matters, because services are never CE marked. If anyone in your organisation is preparing to affix a CE mark to a website, stop them.

The conformity assessment route: Annex IV

The EAA uses a single conformity assessment procedure for products, set out in Annex IV: internal production control. Anyone who has worked with other CE marking directives will recognise it as the Module A pattern.

Internal production control means exactly what it says. There is no notified body. There is no third party certification, no audit by an external laboratory, and no certificate to buy. The manufacturer assesses its own product against the accessibility requirements and declares the result.

This is fast and it is cheap, and both of those facts are the problem. Because nobody external validated your assessment, the entire evidentiary burden sits with you at the moment a market surveillance authority asks a question. There is no certificate to point at. There is only your file.

What the Annex IV file must contain

Annex IV requires technical documentation that makes it possible to assess the product's conformity with the applicable accessibility requirements. In practice that means:

• A general description of the product
• A list of the harmonised standards and technical specifications applied
• Where a harmonised standard was applied only in part, a description of the parts that were applied and of the other solutions adopted to meet the accessibility requirements
• The design, manufacture and operation detail necessary to assess conformity
• The results of design calculations made and examinations carried out

The third item is the one that generates real work. Partial application of a standard is normal and permitted, but it obliges you to document what you did instead and why it meets the requirement. That is an engineering argument, and engineering arguments are far cheaper to capture while the decision is being made than to reconstruct two years later from a Jira ticket and someone's memory.

Treat the Annex IV file as the document you would hand a regulator tomorrow morning. If assembling it would take your team a month, you do not have one.

The EU Declaration of Conformity and the CE mark

Once the assessment is complete, the manufacturer draws up an EU Declaration of Conformity. It states that the applicable accessibility requirements of the directive have been fulfilled, and it follows the model structure set out in Annex III of Decision No 768/2008/EC.

Where a product falls under more than one Union act requiring a declaration of conformity, you draw up a single declaration covering all of them, identifying each act. Most in-scope products are already carrying radio equipment, EMC or low voltage obligations, so in practice this means adding the EAA to an existing document rather than creating a new one. That is an advantage: it puts accessibility in front of the people who already own conformity paperwork.

The CE mark then goes on the product itself, visibly, legibly and indelibly. Where the nature of the product does not allow that, it goes on the packaging and the accompanying documents. It must be affixed before the product is placed on the market.

It is worth being blunt about what the CE mark means, because it is routinely misread as a badge someone granted you. It is not. It is a claim you are making, in your own name, that the product meets the requirements. If the claim is untrue, the false claim is itself the violation, independent of the underlying accessibility failure.

Five years, and two different clocks

The manufacturer must keep the technical documentation and the EU Declaration of Conformity for five years after the product has been placed on the market. Importers must keep a copy of the declaration available for the same period.

For services, the corresponding record keeping duty runs for five years after the service was last provided. That is a different clock with a different trigger, and organisations that sell both products and services routinely apply one rule to both. Check which one your retention policy actually implements.

Who owes what

The EAA distributes obligations across four roles. The term of art is "economic operator", and which one you are is a question of what you do, not what you call yourself.

Role	Core duties	Documentation held	Can it be delegated
Manufacturer	Design to the accessibility requirements, run the Annex IV assessment, draw up the DoC, affix CE marking, keep series production conformant, maintain a register of non-conforming products and recalls	Technical documentation and DoC, five years	No
Authorised representative	Acts under written mandate: holds documentation, cooperates with authorities	DoC and technical documentation, at the authority's disposal	Receives delegated tasks only
Importer	Verify conformity before placing on the market, add own name and address, ensure storage and transport do not compromise conformity	Copy of the DoC, five years	No
Distributor	Act with due care, verify marking and documentation are present and in the right language	None required	No

Manufacturers

Manufacturers carry the widest set of duties. They design and manufacture the product in accordance with the accessibility requirements, carry out the Annex IV procedure, draw up the declaration, affix the CE mark, and ensure procedures exist to keep series production in conformity as designs and components change.

They must also indicate their name, registered trade name or registered trade mark and a contact address on the product, or where that is not possible on the packaging or in an accompanying document. Instructions and information must be in a language that consumers and end users can easily understand, as determined by the member state concerned.

And they must keep a register of non-conforming products and product recalls, and keep distributors informed. That register is not an internal quality convenience. It is evidence.

Authorised representatives

A manufacturer may appoint an authorised representative by written mandate. The representative typically keeps the declaration and technical documentation at the disposal of market surveillance authorities, provides information on request, and cooperates on corrective action.

What cannot be delegated is the substance: designing to the requirements and carrying out the conformity assessment remain the manufacturer's obligations. Appointing a representative moves paperwork and contact, not responsibility.

Importers

An importer may place only compliant products on the EU market, and the verification happens before placing, not after a complaint.

Before placing a product on the market, the importer must satisfy itself that the manufacturer carried out the conformity assessment procedure, that the technical documentation exists, that the product bears the CE marking and is accompanied by the required documents, and that the manufacturer's name and contact address appear on the product.

The importer must then add its own name, registered trade name or trade mark and contact address to the product, or to the packaging or an accompanying document. And it must keep a copy of the declaration of conformity available for five years.

In practice this is the role most often performed unknowingly. If your EU entity buys finished goods from a parent or supplier outside the Union and puts them on the market, you are the importer, whatever the intercompany agreement calls you.

Distributors

Distributors owe a duty of due care. Before making a product available, they verify that it bears the CE marking, that it is accompanied by the required documents and by instructions and information in a language easily understood by consumers in the member state concerned, and that the manufacturer and importer have complied with their identification duties.

A distributor who considers or has reason to believe that a product is not in conformity must not make it available until it has been brought into conformity.

The provision that catches people

An importer or distributor who places a product on the market under its own name or trade mark, or who modifies a product already on the market in such a way that conformity is affected, is considered a manufacturer and assumes every manufacturer obligation.

This is the most commercially dangerous sentence in this part of the directive. Private label retail triggers it. So does a system integrator who rebrands a terminal, and arguably so does a reseller who re-images an operating system on hardware before shipping. Organisations in this position frequently believe they are distributors, have no Annex IV file, and are one enquiry away from discovering they are the manufacturer of record.

The duty to report yourself

This is the part of the product regime that surprises people most, and it applies to every economic operator, not only manufacturers.

Where an operator considers or has reason to believe that a product it placed or made available on the market is not in conformity with the directive, it must immediately take the corrective measures necessary to bring the product into conformity, or withdraw it, as appropriate.

And where the product presents a non-conformity, it must immediately inform the competent national authorities of the member states in which it made the product available, giving details of the non-conformity and of any corrective measures taken.

Read that again in operational terms. Discovering an accessibility defect in an in-scope product does not create a remediation ticket. It creates a notification obligation across every market you sold into, triggered not by a regulator's finding but by your own reasonable belief.

There is a parallel duty on request. On a reasoned request from a competent national authority, an operator must provide all information and documentation necessary to demonstrate the conformity of the product, in a language which that authority can easily understand, and must cooperate on any action taken to eliminate non-compliance.

Specialist counsel has begun writing about exactly this. Bird & Bird's 2026 Accessibility Alert on nonconformity and derogation disclosure obligations treats these disclosure duties as a distinct compliance workstream for operators, which is a reasonable signal of where enforcement attention is heading.

The practical consequence for how you run engineering is significant. If a developer files a bug describing an accessibility failure in a shipped terminal, the clock has arguably started. You need a route from that ticket to legal, and you need it before the ticket exists.

What market surveillance authorities can do

EAA product enforcement runs through the national market surveillance apparatus that already handles product safety and CE marked goods. The machinery is not being built from scratch, which is why product enforcement may move faster than the service side once authorities turn to it.

Authorities can require an operator to take corrective action, restrict or prohibit the making available of a product on the national market, order its withdrawal from the market, order a recall, and publicise the non-compliance.

There is no EU wide penalty figure to quote here, because there is none. The directive requires member states to lay down rules on penalties that are effective, proportionate and dissuasive, and each member state has set its own. That variation is the point: a single non-compliant product sold across the Union creates exposure in parallel under a number of different national regimes.

The news hook: EN 301 549 v4.1.1

There is a live development that changes how much weight your technical file has to carry.

EN 301 549 version 4.1.1 was adopted on 24 August 2026. It aligns clauses 9, 10 and 11 with WCAG 2.2, and it adds new Annexes ZA and ZB mapping the standard's requirements to the essential requirements of Directive (EU) 2016/2102 (the Web Accessibility Directive) and Directive (EU) 2019/882 (the EAA). Its citation in the Official Journal of the European Union is expected around October 2026.

The mechanism matters more than the version number. A harmonised standard confers a presumption of conformity only once it has been cited in the Official Journal, and only for the essential requirements its Annex Z mapping covers. The Annex ZB mapping to Directive 2019/882 is precisely what has been missing. Until the citation lands, conformity has to be demonstrated on the merits, which means your Annex IV file is doing the work a presumption would otherwise do for you.

Two pieces of practical advice follow. First, build documentation against v4.1.1 now, because re-papering a technical file after the fact is more expensive than writing it once. Second, be scrupulously accurate in the declaration about which version of which standard was actually applied. A declaration citing a standard you did not test against is a false claim, and false claims are the failure mode this regime punishes most reliably.

Where enforcement stands

We have covered EAA enforcement in depth elsewhere, so briefly: as of mid 2026, no EAA specific fines have been publicly verified. That is not the reassurance it sounds like.

The Dutch Authority for Consumers and Markets has sent information requests to e-commerce operators, including companies headquartered outside the EU. German operators have received private warning letters, the Abmahnung mechanism that lets competitors and associations act before any regulator does. Authorities in both the Netherlands and Germany have signalled increased auditing activity through 2026, as Deque's survey of early enforcement signals documents.

The relevant observation for this article is narrower. Every one of these interventions begins the same way: with a request for documentation. The organisations that handle them well are not the ones with perfect products. They are the ones who can produce the file.

A readiness checklist

If you sell anything physical into the EU, work through this:

1. Scope. Does any SKU fall within the Article 2 product list? Be honest about kiosks, routers, set top boxes and consumer computers.
2. Role. Which economic operator are you for each product line? Check specifically whether private labelling or post-market modification has made you the manufacturer without anyone noticing.
3. The file. Locate the Annex IV technical documentation. If it does not exist, start it now against EN 301 549 v4.1.1 rather than an older version.
4. The declaration. Confirm a current EU Declaration of Conformity exists, follows the Annex III model structure, covers the EAA alongside your other applicable acts, and names the standard version you actually applied.
5. The mark. Confirm CE marking placement meets the visible, legible and indelible test, and that it is applied before placing on the market.
6. Retention. Confirm five year retention is implemented somewhere durable and owned, not in a departed engineer's drive.
7. Escalation. Build a documented route from an engineering bug report to legal review. The notification duty is triggered by reasonable belief, so the moment your organisation knows, the obligation exists whether or not anyone has told a lawyer.

The product side of the EAA is less about accessibility technique than about evidence. The requirements themselves are the same essential requirements you already know. What is different is that you are asserting compliance in your own name, in writing, on the product, with a five year memory and a duty to confess.