In cybersecurity regulation, a manufacturer is the regulated actor that places a product on the market under its own name or trademark. Under the Cyber Resilience Act, this is the party that is treated as responsible for the product’s security posture, even when the software includes upstream open-source code or third-party components.
This role matters because security obligations follow the product that reaches customers, not just the code contributor who wrote it. A manufacturer may need to maintain an accurate SBOM, track vulnerabilities in dependencies, issue fixes, and operate incident and reporting workflows. In real-world defense, this means building ownership into release engineering, patch management, and disclosure processes. In attacks, the manufacturer is the party defenders expect to notify, coordinate with, and hold accountable when a shipped product contains a vulnerable library or a delayed patch exposes users to risk.