The EU's Cyber Resilience Act (CRA) outlines specific obligations for distributors of products with digital elements. Under Article 20, distributors must act with due care. In practice, this means distributors are required to verify that products with digital elements bear the CE marking and that the manufacturer and importer have fulfilled their documentation and information obligations before making a product available on the market. If a distributor has reason to believe a product is not in conformity with the CRA's essential cybersecurity requirements, they must not place it on the market until it is compliant. Should a product present a significant cybersecurity risk, the distributor must inform the manufacturer and the market surveillance authorities. For products already on the market, if a distributor becomes aware of a non-conformity or a vulnerability, they must inform the manufacturer without delay and ensure corrective measures, such as withdrawal or recall, are taken. Distributors are also obligated to cooperate with market surveillance authorities to eliminate cybersecurity risks and must maintain records to trace products through the supply chain for ten years.